Read the docs
TI-2023-22885 Aliases CVE-2023-42794GHSA-jm7m-8jh6-29hp

Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Priority LOW 37CWE-459Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02304 83rd percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-coyote (Maven): 9.0.81, 8.5.94Red Hat: 4 advisoriesRed Hat: 4 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat9.0.70 – 9.0.80; 8.5.85 – 8.5.93—No fix listedCNA
—org.apache.tomcat:tomcat-coyote (Maven)9.0.70 to before 9.0.819.0.81Patch availableGHSA-jm7m-8jh6-29hp
—org.apache.tomcat:tomcat-coyote (Maven)8.5.85 to before 8.5.948.5.94Patch availableGHSA-jm7m-8jh6-29hp
  • Apache Tomcat VendorApache Affected 9.0.70 – 9.0.80; 8.5.85 – 8.5.93 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 9.0.70 to before 9.0.81 Fixed in 9.0.81 Patch available GHSA-jm7m-8jh6-29hp
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.85 to before 8.5.94 Fixed in 8.5.94 Patch available GHSA-jm7m-8jh6-29hp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*8.5.85 to before 8.5.94; 9.0.70 to before 9.0.81VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.85 to before 8.5.94; 9.0.70 to before 9.0.81 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jm7m-8jh6-29hp org.apache.tomcat:tomcat-coyote (Maven) Fixed in 9.0.81 Advisory →
  • Fix · GHSA-jm7m-8jh6-29hp org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.94 Advisory →

Red Hat 4 advisories

  • RHSA-2024:0474 Released 2024-01-25 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.62-37.el9_3.1, tomcat-admin-webapps-1:9.0.62-37.el9_3.1, tomcat-docs-webapp-1:9.0.62-37.el9_3.1 +5
  • RHSA-2024:0125 Released 2024-01-10 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.62-27.el8_9.2, tomcat-admin-webapps-1:9.0.62-27.el8_9.2, tomcat-docs-webapp-1:9.0.62-27.el8_9.2 +5
  • RHSA-2023:7623 Released 2023-12-07 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.7.7 release and security update
    • Red Hat JBoss Web Server 5
Show 1 more Red Hat advisories
  • RHSA-2023:7247 Released 2023-11-15 · Red Hat rating Critical
    Red Hat Fuse 7.12.1 release and security update
    • Red Hat Fuse 7.12.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:0125
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:0474
Red Hat Fuse 7.12.1Fixed RHSA-2023:7247
Red Hat JBoss Web Server 5Fixed RHSA-2023:7623
Not affected: 10 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42794
  2. 2026-10-03 Alias added: GHSA-jm7m-8jh6-29hp
  3. 2026-10-08 CISA SSVC decision points changed

References

Advisory 3

Other 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences