title: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
description: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.
problem types: CWE-770 Allocation of Resources Without Limits or Throttling
affected:
{
defaultStatus: unaffected
product: Apache Commons FileUpload
vendor: Apache Software Foundation
versions:
lessThan: 1.5, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: Apache Tomcat
vendor: Apache Software Foundation
versions:
status: affected, version: 11.0.0-M1
lessThanOrEqual: 10.1.4, status: affected, version: 10.0.0-M1, versionType: semver
lessThanOrEqual: 9.0.70, status: affected, version: 9.0.0-M1, versionType: semver
lessThanOrEqual: 8.5.84, status: affected, version: 8.5.0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]