{"cve":"CVE-2023-42794","nvd":{"published":"2023-10-10T18:15:18.863","modified":"2026-10-08T22:17:25.113","status":"Modified","description":"Incomplete Cleanup vulnerability in Apache Tomcat.\n\nThe internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, \nin progress refactoring that exposed a potential denial of service on \nWindows if a web application opened a stream for an uploaded file but \nfailed to close the stream. The file would never be deleted from disk \ncreating the possibility of an eventual denial of service due to the \ndisk being full.\n\nOther, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},"cwes":["CWE-459"],"references":["https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82","http://www.openwall.com/lists/oss-security/2023/10/10/8","https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82"],"products":["apache:tomcat"],"source":"nvd","synced_at":"2026-10-19T21:39:34.467980132+00:00"},"epss":{"cve":"CVE-2023-42794","score":0.02304,"percentile":0.83208,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-jm7m-8jh6-29hp","url":"https://osv.dev/vulnerability/GHSA-jm7m-8jh6-29hp","summary":"Apache Tomcat Incomplete Cleanup vulnerability","modified":"2025-02-13T19:16:22Z","packages":[{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote","ranges":[">=9.0.70 <9.0.81"],"fixed":["9.0.81"]},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote","ranges":[">=8.5.85 <8.5.94"],"fixed":["8.5.94"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}