| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.1.5, < 10.1.8≥ 11.0.0-M2, < 11.0.0-M5≥ 9.0.71, < 9.0.74 | 10.1.811.0.0-M59.0.74 |
| org.apache.tomcat:tomcat-coyote | ≥ 8.5.85, < 8.5.88 | 8.5.88 |
| tomcat | = 11.0.0≥ 10.1.5, ≤ 10.1.7≥ 8.5.85, ≤ 8.5.87≥ 9.0.71, ≤ 9.0.73 |
The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free