The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
History

Wed, 20 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published: 2023-05-22T10:08:49.541Z

Updated: 2024-11-20T18:13:44.180Z

Reserved: 2023-03-21T17:28:47.353Z

Link: CVE-2023-28709

cve-icon Vulnrichment

Updated: 2024-08-02T13:43:23.741Z

cve-icon NVD

Status : Modified

Published: 2023-05-22T11:15:09.423

Modified: 2024-11-21T07:55:51.010

Link: CVE-2023-28709

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-05-22T00:00:00Z

Links: CVE-2023-28709 - Bugzilla