CVE: 2023-28709 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Denial Of Service (DoS)
Vulnerability description	org.apache.tomcat:tomcat-coyote is vulnerable to Denial Of Service (DoS). Bypassing the restriction on uploaded request parts may result in a Denial of Service if HTTP connector settings are different from the default. The Denial of Service may occur if a request query string exactly matches the maxParameterCount parameters.
CVE	2023-28709
CVSS score	7.1
Vulnerability present in version/s	9.0.0.M1-9.0.73
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.74
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/40657
• Patch: apache/tomcat@fbd8142