Fixed in Apache Tomcat 9.0.74

Moderate: Apache Tomcat denial of service CVE-2023-28709

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

This was fixed with commit fbd81421.

This issue was reported to the Tomcat Security Team on 13 March 2023. The issue was made public on 22 May 2023.

Affects: 9.0.71 to 9.0.73