Apache Tomcat Incomplete Cleanup vulnerability

TRUNG BÌNH 5.9CVE-2023-42794 · BIT-tomcat-2023-42794 · GHSA-jm7m-8jh6-29hp · Công bố 10/10/2023 · cập nhật 08/10/2026

Tóm tắt nhanh

CVE-2023-42794 là lỗ hổng mức TRUNG BÌNH (CVSS 5.9) ảnh hưởng org.apache.tomcat:tomcat-coyote, tomcat (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.3%, cao hơn 83.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 8.5.94, 9.0.81 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.tomcat:tomcat-coyote Maven	`≥ 8.5.85, < 8.5.94≥ 9.0.70, < 9.0.81`	`8.5.949.0.81`
tomcat apache	`≥ 8.5.85, < 8.5.94≥ 9.0.70, < 9.0.81`	`8.5.949.0.81`

Mô tả

Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

Mô tả của NVD

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.