Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-tomcatalma-upgrade-tomcat-admin-webappsalma-upgrade-tomcat-docs-webappalma-upgrade-tomcat-el-3.0-apialma-upgrade-tomcat-jsp-2.3-apialma-upgrade-tomcat-libalma-upgrade-tomcat-servlet-4.0-apialma-upgrade-tomcat-webapps | Nov 16, 2023 | Feb 20, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-2-2-apiamazon-linux-ami-2-upgrade-tomcat-el-3-0-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-2-apiamazon-linux-ami-2-upgrade-tomcat-jsp-2-3-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-0-apiamazon-linux-ami-2-upgrade-tomcat-servlet-3-1-apiamazon-linux-ami-2-upgrade-tomcat-servlet-4-0-apiamazon-linux-ami-2-upgrade-tomcat-webapps | Sep 28, 2023 | Feb 20, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-tomcat7amazon-linux-upgrade-tomcat8 | May 4, 2023 | Feb 20, 2023 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_85apache-tomcat-upgrade-9_0_71apache-tomcat-upgrade-10_1_5apache-tomcat-upgrade-11_0_0apache-tomcat-10_1apache-tomcat-11_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Feb 21, 2023 | Feb 20, 2023 | |
| Centos_linux | — | centos-upgrade-tomcatcentos-upgrade-tomcat-admin-webappscentos-upgrade-tomcat-docs-webappcentos-upgrade-tomcat-el-3-0-apicentos-upgrade-tomcat-jsp-2-3-apicentos-upgrade-tomcat-libcentos-upgrade-tomcat-servlet-4-0-apicentos-upgrade-tomcat-webapps | Nov 8, 2023 | Feb 20, 2023 |
| Debian | debian-upgrade-libcommons-fileupload-javadebian-upgrade-tomcat10debian-upgrade-tomcat9 | Oct 12, 2023 | Feb 20, 2023 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Mar 18, 2023 | |
| Freebsd | freebsd-upgrade-package-jenkinsfreebsd-upgrade-package-jenkins-lts | Mar 23, 2023 | Mar 9, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-tomcat | May 31, 2023 | Feb 20, 2023 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-tomcathuawei-euleros-2_0_sp5-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp5-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-libhuawei-euleros-2_0_sp5-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp5-upgrade-tomcat-webapps | Jun 9, 2023 | Feb 20, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | Apr 13, 2023 | Feb 20, 2023 | |
| Ibm Was | ibm-was-upgrade-latest | May 12, 2023 | Feb 20, 2023 | |
| Oracle Missing Cpu Apr 2023 | oracle-apply-apr-2023-cpu | Apr 27, 2023 | Feb 20, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-3-0-apioracle-linux-upgrade-tomcat-jsp-2-3-apioracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-4-0-apioracle-linux-upgrade-tomcat-webapps | Nov 16, 2023 | Feb 20, 2023 |
| Redhat_linux | redhat-upgrade-tomcatredhat-upgrade-tomcat-admin-webappsredhat-upgrade-tomcat-docs-webappredhat-upgrade-tomcat-el-3-0-apiredhat-upgrade-tomcat-jsp-2-3-apiredhat-upgrade-tomcat-libredhat-upgrade-tomcat-servlet-4-0-apiredhat-upgrade-tomcat-webapps | Nov 8, 2023 | Feb 20, 2023 | |
| Suse | — | suse-upgrade-apache-commons-fileuploadsuse-upgrade-apache-commons-fileupload-javadocsuse-upgrade-jakarta-commons-fileuploadsuse-upgrade-jakarta-commons-fileupload-javadocsuse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-3_1-apisuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Mar 13, 2023 | Feb 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub