5.9

CVE-2023-42794: Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Modified
AliasesCGA-24j5-qfh7-672mCGA-49rx-mjmx-28vqGHSA-jm7m-8jh6-29hp
Published 10-10-2023Last modified 08-10-2026

Vulnerability summary

CVE-2023-42794 is a medium (CVSS 5.9) Incomplete Cleanup vulnerability in apache software foundation apache tomcat. EPSS estimates a 2.30% chance of exploitation in the next 30 days, higher than 83.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.9/10
010
Medium · v3.1 (NVD)
EPSS score
2.30%
0%100%
Low · +0.45 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
OPENSUSE-SU-2024:13382-1RHSA-2024:0125RHSA-2024:0474SUSE-SU-2024:0472-1CGA-2282-6PW8-33QRUBUNTU-CVE-2023-42794

Timeline

  1. 10-10-2023
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

2.30%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

Increase +0.45 pp

From 1.85% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apache1 product
  • tomcat≥ 8.5.85, < 8.5.94 | ≥ 9.0.70, < 9.0.81
Apache software foundation1 product
Chainguard1 product
  • tomcat-8.5.87All versions (No fix recorded)
Org.apache.tomcat1 product
  • tomcat-coyote≥ 9.0.70, < 9.0.81 | ≥ 8.5.85, < 8.5.94

4 vendors · 4 products

References

4 links