Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Priority HIGH 70CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 24 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.48788 98th percentileScored 2026-11-07
Fix Partial Apache Commons FileUpload (Apache Software Foundation): 1.5commons-fileupload:commons-fileupload (Maven): 1.5+3 more productsRed Hat: 8 advisoriesRed Hat: 10 fixed, 24 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons FileUpload | before 1.5 | 1.5 | Patch available | CNA |
| Apache | Apache Tomcat | 11.0.0-M1; 10.0.0-M1 – 10.1.4; 9.0.0-M1 – 9.0.70; 8.5.0 – 8.5.84 | — | No fix listed | CNA |
| — | commons-fileupload:commons-fileupload (Maven) | before 1.5 | 1.5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 10.1.0-M1 to before 10.1.5 | 10.1.5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 11.0.0-M2 to before 11.0.0-M5 | 11.0.0-M5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 8.5.85 to before 8.5.88 | 8.5.88 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 9.0.0-M1 to before 9.0.71 | 9.0.71 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 10.1.0-M1 to before 10.1.5 | 10.1.5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 11.0.0-M2 to before 11.0.0-M5 | 11.0.0-M5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.85 to before 8.5.88 | 8.5.88 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0-M1 to before 9.0.71 | 9.0.71 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 10.1.0-M1 to before 10.1.5 | 10.1.5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 11.0.0-M2 to before 11.0.0-M5 | 11.0.0-M5 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.5.85 to before 8.5.88 | 8.5.88 | Patch available | GHSA-hfrx-6qgj-fp6c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 9.0.0-M1 to before 9.0.71 | 9.0.71 | Patch available | GHSA-hfrx-6qgj-fp6c |
- Apache Commons FileUpload VendorApache Affected before 1.5 Fixed in 1.5 Patch available CNA
- Apache Tomcat VendorApache Affected 11.0.0-M1; 10.0.0-M1 – 10.1.4; 9.0.0-M1 – 9.0.70; 8.5.0 – 8.5.84 Fixed in — No fix listed CNA
- commons-fileupload:commons-fileupload (Maven) Vendor— Affected before 1.5 Fixed in 1.5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.5 Fixed in 10.1.5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 11.0.0-M2 to before 11.0.0-M5 Fixed in 11.0.0-M5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.85 to before 8.5.88 Fixed in 8.5.88 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.71 Fixed in 9.0.71 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.5 Fixed in 10.1.5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 11.0.0-M2 to before 11.0.0-M5 Fixed in 11.0.0-M5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.85 to before 8.5.88 Fixed in 8.5.88 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.71 Fixed in 9.0.71 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.5 Fixed in 10.1.5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 11.0.0-M2 to before 11.0.0-M5 Fixed in 11.0.0-M5 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.85 to before 8.5.88 Fixed in 8.5.88 Patch available GHSA-hfrx-6qgj-fp6c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.71 Fixed in 9.0.71 Patch available GHSA-hfrx-6qgj-fp6c
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* | 1.0 to before 1.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:commons_fileupload:1.0:beta:*:*:*:*:*:* | 1.0 beta | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* Versions 1.0 to before 1.5 Vulnerable ·Apache
- cpe:2.3:a:apache:commons_fileupload:1.0:beta:*:*:*:*:*:* Versions 1.0 beta Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA Apache Commons FileUpload (Apache Software Foundation) Fixed in 1.5
- Fix · GHSA-hfrx-6qgj-fp6c commons-fileupload:commons-fileupload (Maven) Fixed in 1.5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-coyote (Maven) Fixed in 10.1.5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-coyote (Maven) Fixed in 11.0.0-M5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.88 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.71 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 11.0.0-M5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.88 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.71 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 11.0.0-M5 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.88 Advisory →
- Fix · GHSA-hfrx-6qgj-fp6c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.71 Advisory →
Red Hat 8 advisories
- RHSA-2024:3814 Released 2024-06-11 · Red Hat rating Importanttomcat security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat-1:9.0.87-1.el8_8.2, tomcat-admin-webapps-1:9.0.87-1.el8_8.2, tomcat-docs-webapp-1:9.0.87-1.el8_8.2 +5
- RHSA-2023:7065 Released 2023-11-14 · Red Hat rating Moderatetomcat security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.62-27.el8_9, tomcat-admin-webapps-1:9.0.62-27.el8_9, tomcat-docs-webapp-1:9.0.62-27.el8_9 +5
- RHSA-2023:6570 Released 2023-11-07 · Red Hat rating Moderatetomcat security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.62-37.el9_3, tomcat-admin-webapps-1:9.0.62-37.el9_3, tomcat-docs-webapp-1:9.0.62-37.el9_3 +5
Show 5 more Red Hat advisories
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
- RHSA-2023:4910 Released 2023-09-04 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.4 release and security update
- JWS 5.7.4 release
- RHSA-2023:4909 Released 2023-09-04 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.4 release and security update
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el7jws +10
- Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el8jws +8
- Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el9jws +8
- RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat support for Spring Boot | Affected | No fix yet |
| JWS 5.7.4 release | Fixed | RHSA-2023:4910 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2023:3299 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7065 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6570 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:3814 |
| Red Hat JBoss Web Server 5.7 for RHEL 7 Server | Fixed | RHSA-2023:4909 |
| Red Hat JBoss Web Server 5.7 for RHEL 8 | Fixed | RHSA-2023:4909 |
| Red Hat JBoss Web Server 5.7 for RHEL 9 | Fixed | RHSA-2023:4909 |
Not affected: 9 products
- A-MQ Clients 2
- OpenShift Developer Tools and Services for OCP 4.13
- Red Hat AMQ Broker 7
- Red Hat Enterprise Linux 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server
- Red Hat JBoss Web Server 5.7 for RHEL 8
- Red Hat JBoss Web Server 5.7 for RHEL 9
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24998
- 2026-10-03 Alias added: GHSA-hfrx-6qgj-fp6c
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: MEDIUM → HIGH
References
Advisory 5
Other 16
- http://www.openwall.com/lists/oss-security/2023/05/22/1
- https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17
- https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce
- https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e
- https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74
- https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38
- https://tomcat.apache.org/security-9.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-10.html
- https://security.netapp.com/advisory/ntap-20241108-0002
- https://security.netapp.com/advisory/ntap-20230302-0013
- https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html
- https://github.com/search?q=repo%3Aapache%2Ftomcat+util.http+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://github.com/apache/commons-fileupload
- https://commons.apache.org/proper/commons-fileupload/security-reports.html
More Apache Commons Fileupload vulnerabilities
- TI-2014-00048 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat… CVSS 3.1HIGH 7.5
- TI-2016-09287 Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2016-02591 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache… CVSS 3.1HIGH 7.5
- TI-2025-31104 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers CVSS 3.1HIGH 7.5
- TI-2013-00182 The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2023-24998 · CVE Program
- CVE-2023-24998 · NVD
- FIRST EPSS
- GHSA-hfrx-6qgj-fp6c · GitHub Advisory Database · CC BY 4.0
- CVE-2023-24998 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences