The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-api | Nov 16, 2023 | May 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-3.1-api | Sep 28, 2023 | May 22, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Jul 20, 2023 | May 22, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.74Upgrade Apache Tomcat to 8.5.88Upgrade Apache Tomcat to 10.1.8Upgrade Apache Tomcat to 11.0.0 | May 23, 2023 | May 22, 2023 |
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webapps | Nov 8, 2023 | May 22, 2023 |
| Debian | — | Upgrade tomcat10 | Oct 19, 2023 | May 22, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jun 29, 2023 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | May 22, 2023 |
| Oracle_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-lib | Nov 16, 2023 | May 22, 2023 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-4.0-apiNo solution existsUpgrade tomcat-webappsUpgrade tomcat-el-3.0-api | Nov 8, 2023 | May 22, 2023 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-docs-webapp | May 31, 2023 | May 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub