CVE-2023-24998 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Attackers can cause denial of service by sending excessive file upload parts, affecting applications using Apache Commons FileUpload.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-24998?
CVE-2023-24998 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 20 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Weakness: CWE-770
Which versions are affected by CVE-2023-24998?
26 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, commons-fileupload:commons-fileupload and org.apache.tomcat:tomcat-catalina. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.85 | 8.5.88 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.85 | 8.5.88 |
20 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.71 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.71 |
commons-fileupload:commons-fileupload Maven | All versions | 1.5 |
commons-fileupload:commons-fileupload Maven | All versions | 1.5 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.85 | 8.5.88 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.85 | 8.5.88 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.71 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.71 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat:tomcat-coyote Maven | From 10.1.0-M1 | 10.1.5 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat:tomcat-coyote Maven | From 11.0.0-M2 | 11.0.0-M5 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.85 | 8.5.88 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.85 | 8.5.88 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.71 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.71 |
Linux distribution packages (14)
apache-commons-fileupload SUSE:Enterprise Storage 7 | All versions | 1.5-150200.3.9.1 |
apache-commons-fileupload SUSE:Enterprise Storage 7.1 | All versions | 1.5-150200.3.9.1 |
tomcat SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 9.0.36-150100.4.87.1 |
apache-commons-fileupload SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.5-150200.3.9.1 |
apache-commons-fileupload SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.5-150200.3.9.1 |
apache-commons-fileupload SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.5-150200.3.9.1 |
apache-commons-fileupload SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | All versions | 1.5-150200.3.9.1 |
apache-commons-fileupload SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | All versions | 1.5-150200.3.9.1 |
tomcat SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 8.0.53-29.63.1 |
tomcat SUSE:Linux Enterprise Server 12 SP4-ESPOS | All versions | 9.0.36-3.99.1 |
tomcat SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 9.0.36-3.99.1 |
tomcat SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.0.36-3.99.1 |
tomcat SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 9.0.36-150100.4.87.1 |
apache-commons-fileupload SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.5-150200.3.9.1 |
Products include Apache Commons Fileupload, Debian Debian Linux.
How do I fix CVE-2023-24998?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.5, 11.0.0-M5, 8.5.88 or 9.0.71.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-24998 being exploited?
There is no known exploitation of CVE-2023-24998 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
- CVE-2016-1000031 Improper Access Control in commons-fileupload
- CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
- CVE-2016-3092 High severity vulnerability that affects commons-fileupload:commons-fileupload
- CVE-2014-0050 Commons FileUpload Denial of service vulnerability
- CVE-2013-0248 Incorrect Default Permissions in Apache Commons FileUpload
Sources
Also known as CLEANSTART-2026-VW03331, CLSA-2026-1779410887, CLSA-2026-1780929699, DEBIAN-CVE-2023-24998, GHSA-hfrx-6qgj-fp6c, MGASA-2023-0070 and 10 more.