{"id":"CVE-2023-42794","details":"Incomplete Cleanup vulnerability in Apache Tomcat.\n\nThe internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, \nin progress refactoring that exposed a potential denial of service on \nWindows if a web application opened a stream for an uploaded file but \nfailed to close the stream. The file would never be deleted from disk \ncreating the possibility of an eventual denial of service due to the \ndisk being full.\n\nOther, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","aliases":["BIT-tomcat-2023-42794","GHSA-jm7m-8jh6-29hp"],"modified":"2026-04-12T07:19:43.920602Z","published":"2023-10-10T18:15:18.863Z","related":["ALSA-2024:0125","ALSA-2024:0474","SUSE-SU-2024:0472-1","openSUSE-SU-2024:13382-1"],"references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2023/10/10/8"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat","events":[{"introduced":"7b1f4ce0b82641bf76a3d763bd97d5522513b57b"},{"fixed":"36d4f7d698f71cd322204a3b242a97c54860fb8c"},{"introduced":"55a52d8475b8b3ec8ebda739f8c6b4fdeac173d9"},{"fixed":"90a0120a60faf9a3a657b113a7e2cdda2112be91"}],"database_specific":{"cpe":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","source":"CPE_FIELD","extracted_events":[{"introduced":"8.5.85"},{"fixed":"8.5.94"},{"introduced":"9.0.70"},{"fixed":"9.0.81"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-42794.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}