UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28709

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded…

Severity
High 7.5
Published
22 May 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 8.5.85 up to 8.5.87
  • From 9.0.71 up to 9.0.73
  • From 10.1.5 up to 10.1.7
  • Version 11.0.0-milestone2
  • Version 11.0.0-milestone3
  • Version 11.0.0-milestone4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28709
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28709