CVE-2023-28709

A vulnerability has been identified in Apache Tomcat due to an incomplete fix for CVE-2023-24998, which aims to limit the uploaded request parts that can be bypassed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to cause a crash triggering a denial of service.

The impact for this flaw is considered moderate to match the Apache Software Foundation impact, considering the non-default configuration in CVE description.

pki-servlet-engine has been obsoleted in Red Hat Enterprise Linux 8.9 and later by Tomcat, so no additional fixes for the engine would be made available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.