CVE-2023-42794: Apache Tomcat · Incomplete Cleanup
Affects Apache TomcatSource CVE Database V5
Not known to be exploited · fixed in 9.0.81 : update Apache Tomcat when convenient.
Data as of 26 Oct 2026, 06:26 UTC
Rated Medium by the CNA (apache) · No CVSS score from NVD or the CNA
- EPSS
- 2.3% chance of exploitation in 30 days – higher than 83% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 9.0.81
Exploitation evidence
Disclosed: evidence found.
CVE published 10 Oct 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavenorg.apache.tomcat/tomcatpkg:maven/org.apache.tomcat/tomcatOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should upgrade Apache Tomcat to version 9.0.81 or later, or 8.5.94 or later, where this incomplete cleanup issue is fixed. No other mitigations are indicated by the vendor advisory.
Description
CVE-2023-42794 is an incomplete cleanup vulnerability in Apache Tomcat affecting versions 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93. The issue arises from an internal fork of Commons FileUpload that included an unreleased refactoring, which can cause uploaded files on Windows systems to remain undeleted if a stream is opened but not closed. This can lead to disk space exhaustion and a potential denial of service. The vulnerability is fixed in Apache Tomcat versions 9.0.81 and later, and 8.5.94 and later.