CVE-2023-42794

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

• CWE-459

• https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/10/10/8Mailing List, Third Party Advisory
• https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82Mailing List, Vendor Advisory

Published

Oct 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42789A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.…9.8
• CVE-2023-4279This User Activity Log WordPress plugin before 1.6.7 retriev…7.5
• CVE-2023-42790A stack-based buffer overflow vulnerability in Fortinet Fort…8.1
• CVE-2023-42791A relative path traversal in Fortinet FortiManager version 7…8.8
• CVE-2023-42792Apache Airflow, in versions prior to 2.7.2, contains a secur…6.5
• CVE-2023-42793In JetBrains TeamCity before 2023.05.4 authentication bypass…9.8
• CVE-2023-42795Incomplete Cleanup vulnerability in Apache Tomcat.When recyc…5.3
• CVE-2023-42796A vulnerability has been identified in CP-8031 MASTER MODULE…8.8
• CVE-2023-42797A vulnerability has been identified in CP-8031 MASTER MODULE…7.2
• CVE-2023-42798AutomataCI is a template git repository equipped with a nati…9.1
• CVE-2023-42799Moonlight-common-c contains the core GameStream client code …8.8
• CVE-2023-4280An unvalidated input in Silicon Labs TrustZone implementatio…9.8