Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-42794

CVE-2023-42794MEDIUM

Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  N  N  H    5.9   .0230   83.0     —

AFFECTED
  Product        Versions  Fixed
  Apache Tomcat  9.0.70 –  —

TIMELINE
  Sep 14  Reserved by apache
  Oct 10  Published (CNA: apache)
  Oct 8   ENRICHED — CVE-2023-42794 (Apache Software Foundation Apache Tomcat). Received CVSS 5.9 and CPE data from NVD.

CWE-459 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Modified

Description

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 14, 2023	Reserved	Reserved by apache
October 10, 2023	Published	Published (CNA: apache)
October 8, 2026	ENRICHED	ENRICHED — CVE-2023-42794 (Apache Software Foundation Apache Tomcat). Received CVSS 5.9 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apache Software Foundation	Apache Tomcat	—	9.0.70	—

Weaknesses

CWE-459

References (2)

http://www.openwall.com/lists/oss-security/2023/10/10/8 [Mailing List, Third Party Advisory]
https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82 [Mailing List, Vendor Advisory]

Authoritative record: CVE-2023-42794 at cve.org

Vendors: apache

Weaknesses: CWE-459

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-42794 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.