Vulnerability record · CVE-2023-28709 · published 22 May 2023
CVE-2023-28709: Apache Tomcat maxParameterCount bypass enables denial of service
Apache · Tomcat
The fix for CVE-2023-24998 was incomplete in several Apache Tomcat releases, allowing the maxParameterCount limit to be bypassed when non-default HTTP connector settings are used. A request supplying exactly maxParameterCount query string parameters can exceed the intended limit for uploaded request parts, potentially causing a denial of service.
Description
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 with network reachability and no authentication required, plus a high EPSS score, make this a significant denial-of-service risk despite no known exploitation.
What it is
The fix for CVE-2023-24998 was incomplete in several Apache Tomcat releases, allowing the maxParameterCount limit to be bypassed when non-default HTTP connector settings are used. A request supplying exactly maxParameterCount query string parameters can exceed the intended limit for uploaded request parts, potentially causing a denial of service.
Impact
An unauthenticated remote attacker can bypass the parameter count limit and consume excessive server resources, leading to a denial of service. There is no impact to confidentiality or integrity.
Attack surface
Reachable over the network via HTTP requests to a vulnerable Tomcat connector configured with non-default maxParameterCount settings. No authentication or user interaction is required.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged; EPSS indicates a high probability of exploitation activity (0.48031, 98.8th percentile), but no confirmed in-the-wild exploitation is documented in this record.
What to do
- Upgrade Apache Tomcat to a version that fully addresses CVE-2023-24998 and CVE-2023-28709 (11.0.0-M5+, 10.1.8+, 9.0.74+, 8.5.88+).
- Apply vendor patches from Debian, Gentoo, or NetApp advisories where Tomcat is bundled.
- Review and tighten non-default HTTP connector settings, particularly maxParameterCount and related limits.
- If patching is delayed, restrict network access to Tomcat connectors and monitor for abnormal request volumes.
Detection
- Monitor HTTP access logs for requests with query strings containing exactly maxParameterCount parameters.
- Alert on sudden spikes in request part counts or resource exhaustion on Tomcat connectors.
- Track server error rates and thread pool saturation that may indicate parameter limit bypass attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/05/22/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j | Mailing ListVendor Advisory |
| https://security.gentoo.org/glsa/202305-37 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230616-0004/ | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5521 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2023/05/22/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j | Mailing ListVendor Advisory |
| https://security.gentoo.org/glsa/202305-37 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230616-0004/ | Third Party Advisory |
| https://www.debian.org/security/2023/dsa-5521 | Third Party Advisory |
Track CVE-2023-28709 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-28709), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
