CVE-2025-48976
published 2025-06-16CVE-2025-48976: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | >= 1.0 < 1.6 | 1.6 |
| apache_software_foundation | apache_commons_fileupload | >= 1.0 < 1.6 | 1.6 |
| apache_software_foundation | apache_commons_fileupload | >= 2.0.0-M1 < 2.0.0-M4 | 2.0.0-M4 |
| debian | libcommons-fileupload-java | < libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) | libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) |
| debian | tomcat10 | < libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) | libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) |
| debian | tomcat11 | < libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) | libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) |
| debian | tomcat9 | < libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) | libcommons-fileupload-java 1.4-1+deb11u1 (bullseye) |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH