5.9

UBUNTU-CVE-2023-42794: tomcat10 Ubuntu

CVSS: 5.9v3.1MediumPublished
Published 10-10-2023Last modified 04-02-2026
Open JSON

Vulnerability summary

UBUNTU-CVE-2023-42794 is a medium (CVSS 5.9) vulnerability in tomcat10 Ubuntu.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (OSV · Ubuntu), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CVE-2023-42794

Timeline

  1. 10-10-2023
    PublishedVulnerability first disclosed.
  2. 04-02-2026
    Last modifiedVulnerability information updated.

Description

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu3 products
  • tomcat10All versions (No fix recorded)
  • tomcat8All versions (No fix recorded)
  • tomcat9All versions (No fix recorded)

1 vendor · 3 products

References

5 links