CVE-2023-28709: Off-by-one Error

May 22, 2023 (updated February 16, 2024)

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

References

www.openwall.com/lists/oss-security/2023/05/22/1
lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j
nvd.nist.gov/vuln/detail/CVE-2023-28709

Code Behaviors & Features

Detect and mitigate CVE-2023-28709 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →