BIT-tomcat-2023-42794

    Dashboard / Vulnerabilities / BIT-tomcat-2023-42794

    BIT-tomcat-2023-42794

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

    Details: Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

    References: http://www.openwall.com/lists/oss-security/2023/10/10/8, https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82, https://nvd.nist.gov/vuln/detail/CVE-2023-42794

    Affected packages

    Package

    Name: tomcat

    Purl: pkg:bitnami/tomcat

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 8.5.85
    Fixed -8.5.94

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-tomcat-2023-42794 | CVE-DB