title: Apache Tomcat: Fix for CVE-2023-24998 is incomplete
description: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
problem types: CWE-193 Off-by-one Error
affected:
{
defaultStatus: unaffected
product: Apache Tomcat
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 11.0.0-M4, status: affected, version: 11.0.0-M2, versionType: semver
lessThanOrEqual: 10.1.7, status: affected, version: 10.1.5, versionType: semver
lessThanOrEqual: 9.0.73, status: affected, version: 9.0.71, versionType: semver
lessThanOrEqual: 8.5.87, status: affected, version: 8.5.85, versionType: semver
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]