Re: File upload and download issue in Tomcat 9.0.106

[Christopher Schultz]

Jianh,

On 9/24/25 4:58 AM, jianhlang wrote:
When i use Tomcat 9.0.105(no configures changed) to deploy my app and upload a 
pdf file on a function,everything goes well,and pdf file uploaded.
But when change to Tomcat 9.0.106(no configures changed) to deploy the same 
app, then upload the same file,the page auto refreshed and file stream is null.
The network in firefox showed 'Request has been truncated'

env as below
both win11 and linux facing this issue.
java-1.8.0-openjdk-1.8.0.345
<dependency&gt;
  &nbsp; &nbsp;<groupId&gt;commons-fileupload</groupId&gt;
  &nbsp; &nbsp;<artifactId&gt;commons-fileupload</artifactId&gt;
  &nbsp; &nbsp;<version&gt;1.5</version&gt;
</dependency&gt;

<dependency&gt;
  &nbsp; &nbsp;<groupId&gt;commons-io</groupId&gt;
  &nbsp; &nbsp;<artifactId&gt;commons-io</artifactId&gt;
  &nbsp; &nbsp;<version&gt;2.5</version&gt;
</dependency&gt;

Here is the changelog for 9.0.106:

https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.106_(remm)

I think this change might be relevant:

"
Provide finer grained control of multi-part request processing via two 
new attributes on the Connector element. maxPartCount limits the total 
number of parts in a multi-part request and maxPartHeaderSize limits the 
size of the headers provided with each part. Add support for these new 
attributes to the ParameterLimitValve.
"

I recommend that you review these new settings:

https://tomcat.apache.org/tomcat-9.0-doc/config/http.html#Common_Attributes

Specifically:

"
maxPartCount - The maximum total number of parts permitted in a request 
where the content type is multipart/form-data. This limit is in addition 
to maxParameterCount. A value of less than 0 means no limit. If not 
specified, a default of 50 is used. Requests that exceed this limit may 
be ignored depending on how the application processes the request. The 
FailedRequestFilter filter can be used to always reject requests that 
exceed the limit.
"

Note that the default limit is 50. If you have mroe than 50 "parts" in 
your <form> (this includes ALL <input>, etc. in the <form>) then you 
might need to raise this limit.

"
maxPartHeaderSize - The maximum number of header bytes permitted per 
part in a request where the content type is multipart/form-data. 
Requests that exceed this limit will be rejected. A value of less than 0 
means no limit. If not specified, a default of 512 is used.
"

You might want to check your Network tab in your browser to see if there 
are any Parts which have large headers. This can happen if the filename 
is unusually large. If you think you need more than 512 bytes per part, 
then you might want to raise this limit.

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org