Apache Tomcat Improper Resource Shutdown Vulnerability in Multipart Upload Processing Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Apache Tomcat versions 11.0.0-M1 prior to 11.0.11, 10.1.0-M1 prior to 10.1.46, and 9.0.0-M1 prior to 9.0.109. This issue arises from improper resource management during multipart file uploads. When an error occurred, such as exceeding upload limits, temporary files created from the uploaded parts were not immediately deleted. Instead, they were left for the garbage collection process to remove. Depending on Java Virtual Machine (JVM) settings, application memory usage, and load, the temporary files could accumulate faster than they were cleared by garbage collection, potentially leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in a denial-of-service condition, where the application becomes unresponsive or unavailable due to excessive memory usage from uncollected temporary files.

Remediation

Users are advised to upgrade to Apache Tomcat 11.0.12 or later, 10.1.47 or later, or 9.0.110 or later.