VYPR
← All advisories
High severityNVD Advisory· Published May 22, 2023· Updated Feb 13, 2025

Apache Tomcat: Fix for CVE-2023-24998 is incomplete

CVE-2023-28709

Description

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Incomplete fix for CVE-2023-24998 in Apache Tomcat allows bypass of uploaded request parts limit using carefully crafted query string parameters, leading to denial of service.

Vulnerability

CVE-2023-28709 is an incomplete fix for CVE-2023-24998 in Apache Tomcat affecting versions 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73, and 8.5.85 to 8.5.87 [1][2][3][4]. When non-default HTTP connector settings are used such that maxParameterCount can be reached via query string parameters, a request supplying exactly maxParameterCount parameters in the query string can bypass the limit for uploaded request parts.

Exploitation

An attacker can exploit this by sending a specially crafted HTTP request with exactly maxParameterCount query string parameters. No authentication is required, but the connector must have non-default settings that allow reaching the limit through query strings. The attack does not require a privileged network position.

Impact

Successful exploitation could allow an attacker to bypass the upload request parts limit, potentially causing a denial of service (DoS) by consuming excessive resources. The vulnerability does not lead to data confidentiality or integrity loss.

Mitigation

Users should upgrade to fixed versions: Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74, or 8.5.88 or later. No workarounds are available. Older branches (8.0.x, 8.5.x, 10.0.x) are end-of-life and should be upgraded to supported versions [1][2][3][4].

References
  1. Apache Tomcat® - Apache Tomcat 8 vulnerabilities
  2. Apache Tomcat® - Apache Tomcat 9 vulnerabilities
  3. Apache Tomcat® - Apache Tomcat 10 vulnerabilities
  4. Apache Tomcat® - Apache Tomcat 11 vulnerabilities

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 11.0.0-M2, < 11.0.0-M511.0.0-M5
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 10.1.5, < 10.1.810.1.8
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 9.0.71, < 9.0.749.0.74
org.apache.tomcat:tomcat-coyoteMaven
>= 8.5.85, < 8.5.888.5.88

Affected products

42

Patches

4
5badf94e79e5

Fix parameter counting logic

https://github.com/apache/tomcatMark ThomasApr 11, 2023via ghsa
commit
1 file changed · +2 −2
  • java/org/apache/tomcat/util/http/Parameters.java+2 −2 modified
    @@ -233,13 +233,13 @@ public void addParameter(String key, String value) throws IllegalStateException
             return;
         }
 
-        parameterCount++;
-        if (limit > -1 && parameterCount > limit) {
+        if (limit > -1 && parameterCount >= limit) {
             // Processing this parameter will push us over the limit. ISE is
             // what Request.parseParts() uses for requests that are too big
             setParseFailedReason(FailReason.TOO_MANY_PARAMETERS);
             throw new IllegalStateException(sm.getString("parameters.maxCountFail", Integer.valueOf(limit)));
         }
+        parameterCount++;
 
         ArrayList<String> values = paramHashValues.get(key);
         if (values == null) {
d53d8e7f7704

Fix parameter counting logic

https://github.com/apache/tomcatMark ThomasApr 11, 2023via ghsa
commit
1 file changed · +2 −2
  • java/org/apache/tomcat/util/http/Parameters.java+2 −2 modified
    @@ -201,13 +201,13 @@ public void addParameter(String key, String value) throws IllegalStateException
             return;
         }
 
-        parameterCount++;
-        if (limit > -1 && parameterCount > limit) {
+        if (limit > -1 && parameterCount >= limit) {
             // Processing this parameter will push us over the limit. ISE is
             // what Request.parseParts() uses for requests that are too big
             setParseFailedReason(FailReason.TOO_MANY_PARAMETERS);
             throw new IllegalStateException(sm.getString("parameters.maxCountFail", Integer.valueOf(limit)));
         }
+        parameterCount++;
 
         paramHashValues.computeIfAbsent(key, k -> new ArrayList<>(1)).add(value);
     }
ba848da71c52

Fix parameter counting logic

https://github.com/apache/tomcatMark ThomasApr 11, 2023via ghsa
commit
1 file changed · +2 −2
  • java/org/apache/tomcat/util/http/Parameters.java+2 −2 modified
    @@ -201,13 +201,13 @@ public void addParameter(String key, String value) throws IllegalStateException
             return;
         }
 
-        parameterCount++;
-        if (limit > -1 && parameterCount > limit) {
+        if (limit > -1 && parameterCount >= limit) {
             // Processing this parameter will push us over the limit. ISE is
             // what Request.parseParts() uses for requests that are too big
             setParseFailedReason(FailReason.TOO_MANY_PARAMETERS);
             throw new IllegalStateException(sm.getString("parameters.maxCountFail", Integer.valueOf(limit)));
         }
+        parameterCount++;
 
         paramHashValues.computeIfAbsent(key, k -> new ArrayList<>(1)).add(value);
     }
fbd81421629a

Fix parameter counting logic

https://github.com/apache/tomcatMark ThomasApr 11, 2023via ghsa
commit
1 file changed · +2 −2
  • java/org/apache/tomcat/util/http/Parameters.java+2 −2 modified
    @@ -201,13 +201,13 @@ public void addParameter(String key, String value) throws IllegalStateException
             return;
         }
 
-        parameterCount++;
-        if (limit > -1 && parameterCount > limit) {
+        if (limit > -1 && parameterCount >= limit) {
             // Processing this parameter will push us over the limit. ISE is
             // what Request.parseParts() uses for requests that are too big
             setParseFailedReason(FailReason.TOO_MANY_PARAMETERS);
             throw new IllegalStateException(sm.getString("parameters.maxCountFail", Integer.valueOf(limit)));
         }
+        parameterCount++;
 
         paramHashValues.computeIfAbsent(key, k -> new ArrayList<>(1)).add(value);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.