Listen to this Post
Apache Tomcat’s multipart upload handling contains an integer overflow vulnerability in versions 9.0.0.M1 to 9.0.106, 10.1.0-M1 to 10.1.42, and 11.0.0-M1 to 11.0.8. When processing multipart/form-data requests, improper size limit checks allow an attacker to craft a malicious payload that triggers an integer overflow. This bypasses configured file size restrictions, leading to excessive memory consumption and a denial-of-service (DoS) condition. The flaw occurs due to insufficient validation when parsing Content-Length headers and chunked transfer encoding.
DailyCVE Form:
Platform: Apache Tomcat
Version: 9.0.0.M1-9.0.106
Vulnerability: Integer Overflow
Severity: Moderate
Date: Jul 10, 2025
Prediction: Patch by Jul 25, 2025
What Undercode Say:
Check Tomcat version: ./catalina.sh version Exploit PoC (simulated): curl -X POST -H "Transfer-Encoding: chunked" --data-binary @oversized_payload http://target:8080/upload
How Exploit:
- Craft multipart request with malformed size headers.
- Trigger integer overflow via oversized payload.
- Exhaust server memory, causing DoS.
Protection from this CVE:
- Upgrade to Tomcat 9.0.107/10.1.43/11.0.9.
- Enforce strict size limits in web.xml.
- Use reverse proxy with request filtering.
Impact:
- Service disruption via memory exhaustion.
- Bypass of upload restrictions.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
