CVE-2023-28709 Apache Tomcat: Fix for CVE-2023-24998 is incomplete

High 7.5 Published 22 May 2023 Updated 13 Feb 2025

Attackers can cause denial of service in Apache Tomcat by bypassing upload limits when non-default connector settings are used.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-28709?

CVE-2023-28709 is a high-severity denial of service vulnerability in Apache Tomcat, published on 22 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

Weakness: CWE-193

Which versions are affected by CVE-2023-28709?

9 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 3 products.

Package	Affected	Fixed in
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.5`	`10.1.8`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `10.1.5`	`10.1.8`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `11.0.0-M2`	`11.0.0-M5`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `11.0.0-M2`	`11.0.0-M5`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.71`	`9.0.74`
`org.apache.tomcat.embed:tomcat-embed-core` Maven	From `9.0.71`	`9.0.74`

3 more packages

`tomcat` Bitnami	From `8.5.85` to `8.5.87`	None
`org.apache.tomcat:tomcat-coyote` Maven	From `8.5.85`	`8.5.88`
`org.apache.tomcat:tomcat-coyote` Maven	From `8.5.85`	`8.5.88`

Linux distribution packages (12)

`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`9.0.36-150100.4.93.1`
`tomcat` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`8.0.53-29.66.1`
`tomcat` SUSE:Linux Enterprise Server 12 SP4-ESPOS	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:Linux Enterprise Server 12 SP4-LTSS	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:Linux Enterprise Server 12 SP5	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`9.0.36-150100.4.93.1`
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`9.0.36-150100.4.93.1`
`tomcat` SUSE:OpenStack Cloud 9	All versions	`9.0.36-3.105.1`
`tomcat` SUSE:OpenStack Cloud Crowbar 9	All versions	`9.0.36-3.105.1`
`tomcat` openSUSE:Tumbleweed	All versions	`9.0.75-1.1`

Products include Apache Tomcat, Debian Debian Linux, Netapp 7-Mode Transition Tool.

How do I fix CVE-2023-28709?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.8, 11.0.0-M5 or 9.0.74.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-28709 being exploited?

There is no known exploitation of CVE-2023-28709 in the wild and no public exploit code.

All Apache Tomcat vulnerabilities

Sources

Also known as BIT-tomcat-2023-28709, DEBIAN-CVE-2023-28709, GHSA-cx6h-86xw-9x34, MGASA-2023-0191, ROOT-APP-MAVEN-CVE-2023-28709, SUSE-SU-2023:2318-1 and 3 more.