| Package | Affected versions | Patched versions |
|---|---|---|
| commons-fileupload:commons-fileupload | < 1.5 | 1.5 |
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.1.0-M1, < 10.1.5≥ 11.0.0-M2, < 11.0.0-M5≥ 8.5.85, < 8.5.88≥ 9.0.0-M1, < 9.0.71 | 10.1.511.0.0-M58.5.889.0.71 |
| org.apache.tomcat:tomcat-catalina | ≥ 10.1.0-M1, < 10.1.5≥ 11.0.0-M2, < 11.0.0-M5≥ 8.5.85, < 8.5.88≥ 9.0.0-M1, < 9.0.71 | 10.1.511.0.0-M58.5.889.0.71 |
| org.apache.tomcat:tomcat-coyote | ≥ 10.1.0-M1, < 10.1.5≥ 11.0.0-M2, < 11.0.0-M5≥ 8.5.85, < 8.5.88≥ 9.0.0-M1, < 9.0.71 | 10.1.511.0.0-M58.5.889.0.71 |
| commons fileupload | = 1.0≥ 1.0, < 1.5 | 1.5 |
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free