CVE-2023-24998: Apache Commons FileUpload unbounded request parts denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) and very high EPSS with a trivial unauthenticated network trigger, though it only causes denial of service and is not known to be exploited in the wild.

What it is

Apache Commons FileUpload before 1.5 does not limit the number of request parts processed, so an attacker can send a malicious upload or a series of uploads to exhaust resources. The new FileUploadBase#setFileCountMax option is not enabled by default, so applications must explicitly configure it even after upgrading.

Impact

An attacker can cause a denial of service, making the file upload endpoint or the hosting application unavailable to legitimate users. There is no confidentiality or integrity impact; the effect is availability loss.

Attack surface

Reachable over the network through any endpoint that parses multipart uploads with the affected library. The CVSS vector shows no privileges and no user interaction required, so an unauthenticated attacker can trigger it directly.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.49 (98.8th percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories and distribution notices, with no public exploit tag.

What to do

• Upgrade Apache Commons FileUpload to 1.5 or later.
• Explicitly set FileUploadBase#setFileCountMax to a sane limit, since it is not enabled by default.
• Apply the Debian, Gentoo or NetApp vendor updates for bundled copies of the library.
• Enforce request size and part-count limits at the reverse proxy or WAF in front of upload endpoints.
• Inventory applications and dependencies that embed Commons FileUpload, including third-party products, and confirm their patched state.

Detection

• Monitor for multipart requests with unusually high part counts or repeated uploads from a single source.
• Alert on spikes in memory, thread or disk usage on servers handling file uploads.
• Log and review 5xx errors or timeouts on upload endpoints for signs of resource exhaustion.
• Track dependency versions to find hosts still running Commons FileUpload before 1.5.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.