Skip to main content

Commons Fileupload EUVDEUVD-2025-18407

| CVE-2025-48976 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2025-06-16 security@apache.org GHSA-vv7r-c36w-3prj
Denial Of Service Apache Java Red Hat Commons Fileupload Suse
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 7.5 indicates high severity with network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high availability impact (A:H). This profile suggests a practical, easily-exploitable vulnerability. The attack complexity is low, meaning no special conditions or timing are required. The fact that this affects resource allocation rather than authentication bypass means the vulnerability is highly reliable to trigger. Real-world risk is elevated given: (1) Commons FileUpload is ubiquitous in Java web applications, (2) the attack is unauthenticated and network-accessible, (3) multipart uploads are standard HTTP functionality, (4) the DoS impact directly affects service availability. EPSS scoring (if available) would likely be elevated due to easy exploitability. Without active KEV listing or confirmed POC in the wild, this should be treated as pre-exploitation risk requiring prompt patching before adversaries develop weaponized exploits.
Exploit ScenarioDerived

An attacker identifies a web application using Apache Commons FileUpload (versions prior to 1.6 or 2.0.0-M4) for file uploads. The attacker crafts an HTTP POST request with Content-Type: multipart/form-data containing either: (1) an extremely large number of form fields/headers, or (2) headers with excessively long values, or (3) deeply nested or malformed multipart boundaries that cause the parser to enter pathological parsing loops. The server's FileUpload parser processes this request without enforcing limits on header count or size, leading to unbounded memory allocation and/or CPU consumption. The server exhausts heap memory or becomes CPU-bound, causing thread starvation and eventual service unavailability. Legitimate users experience timeouts and connection resets. The attacker can repeat this attack to keep the service down with minimal bandwidth expenditure (network-accessible, low-complexity attack). No authentication, user interaction, or special system configuration is required; any web application accepting file uploads via multipart forms is vulnerable.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Apache Commons FileUpload contains a Denial of Service vulnerability in multipart header processing due to insufficient resource allocation limits (CWE-770). Affected versions are 1.0 through 1.5.x and 2.0.0-M1 through 2.0.0-M3. An unauthenticated remote attacker can exploit this with a network request to cause resource exhaustion and service unavailability without requiring user interaction or elevated privileges. CVSS 7.5 (High) reflects the high availability impact; KEV and EPSS data availability would determine exploitation likelihood in the wild.

RemediationAI

  • action: Upgrade to patched version; details: Upgrade Apache Commons FileUpload to version 1.6 or later for 1.x branch, or to version 2.0.0-M4 or later for 2.x milestone builds.
  • action: Dependency management; details: For Maven users, update pom.xml dependency: <dependency><groupId>commons-fileupload</groupId><artifactId>commons-fileupload</artifactId><version>1.6</version></dependency> or <version>2.0.0-M4</version>
  • action: Interim mitigation (if immediate patching impossible); details: Implement application-level request size limits and multipart header count limits in the servlet container or reverse proxy (e.g., nginx, Apache httpd) to enforce maximum header size thresholds and reject oversized multipart requests before they reach FileUpload processing.
  • action: Monitor advisories; details: Monitor Apache Commons FileUpload security advisories and the CVE-2025-48976 tracking for any published POCs or active exploitation indicators that would accelerate patching timelines.

Affected VersionsENISA

Apache Commons FileUpload 2.0.0-M1 <2.0.0-M4
Apache Commons FileUpload 1.0 <1.6

Affected Packages

maven commons-fileupload:commons-fileupload fix: 1.6.0
maven org.apache.commons:commons-fileupload2-core fix: 2.0.0-M4
euvd apache_commons_fileupload fix: 1.6, 2.0.0-M4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache Commons FileUpload is a widely-used Java library for handling file uploads in web applications, particularly in servlet/JSP environments. The vulnerability exists in the multipart/form-data header parsing mechanism, which is invoked during HTTP file upload processing. The root cause (CWE-770: Allocation of Resources Without Limits or Throttling) indicates the parser fails to enforce adequate bounds on resource consumption when processing multipart headers. An attacker can craft malicious multipart requests with excessively large or numerous headers that cause the parser to allocate unbounded memory or CPU resources. This is a classic DoS vector in HTTP request handlers where header limits are not enforced. CPE strings would identify: cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* (versions 1.0-1.5 and 2.0.0-M1 to 2.0.0-M3).

Know when Commons Fileupload gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 5.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jun 16, 2025 - 15:15 nvd
HIGH 7.5

DescriptionCVE.org

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 247 maven packages depend on commons-fileupload:commons-fileupload (43 direct, 205 indirect)
  • 813 maven packages depend on org.apache.commons:commons-fileupload2-core (7 direct, 806 indirect)

Ecosystem-wide dependent count for version 1.0 and other introduced versions.

Executive ViewAI

Why It Matters

Apache Commons FileUpload contains a denial-of-service vulnerability that could allow attackers to exhaust server resources through malformed file upload requests, potentially disrupting application availability. Organizations using affected versions (1.0-1.5 or 2.0.0-M1 to M3) should immediately assess exposure and plan remediation, as no patch is currently available.

Business Impact: High
Compensating Controls

Implement Web Application Firewall (WAF) rules to limit multipart header count and size; configure application servers to enforce strict multipart request limits; implement rate limiting on upload endpoints; monitor for suspicious multipart upload patterns; consider temporary disabling of file upload functionality if not essential to operations; segment upload services to prevent cascade failures.

Threat Intelligence Overview

EPSS Score
0.4%
Top 37% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Commons Fileupload

View all
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2016-1000031 CRITICAL
9.8 Oct 25

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution. Rated critical severity (CV
CVE-2023-24998 HIGH
7.5 Feb 20

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibi
CVE-2016-3092 HIGH
7.5 Jul 04

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x bef
CVE-2013-0248 MEDIUM
6.8 Mar 15

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
libcommons-fileupload-java
Release Status Version
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy needs-triage -
noble needs-triage -
upstream needs-triage -
oracular ignored end of life, was needs-triage
questing needs-triage -
plucky ignored end of life, was needs-triage
tomcat10
Release Status Version
jammy DNE -
oracular ignored end of life, was needs-triage
noble needed -
upstream released 10.1.42
plucky ignored end of life, was needed
questing needed -
tomcat11
Release Status Version
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream released 11.0.8
questing needed -
tomcat9
Release Status Version
noble not-affected 9.0.70-2ubuntu0.1
oracular not-affected -
plucky not-affected -
upstream released 9.0.70-2
bionic needed -
focal needed -
jammy needed -
questing not-affected -

Debian

Bug #1108120
libcommons-fileupload-java
Release Status Fixed Version Urgency
bullseye fixed 1.4-1+deb11u1 -
bullseye (security) fixed 1.4-1+deb11u1 -
bookworm vulnerable 1.4-2 -
forky, sid, trixie vulnerable 1.5-1.1 -
(unstable) fixed (unfixed) -
tomcat10
Release Status Fixed Version Urgency
bookworm fixed 10.1.52-1~deb12u1 -
bookworm (security) fixed 10.1.52-1~deb12u1 -
trixie (security), trixie fixed 10.1.52-1~deb13u1 -
forky, sid fixed 10.1.52-1 -
trixie fixed 10.1.52-1~deb13u1 -
(unstable) fixed 10.1.46-1 -
tomcat11
Release Status Fixed Version Urgency
trixie (security), trixie fixed 11.0.15-1~deb13u1 -
forky, sid fixed 11.0.18-1 -
trixie fixed 11.0.15-1~deb13u1 -
(unstable) fixed 11.0.11-1 -
tomcat9
Release Status Fixed Version Urgency
bullseye fixed 9.0.107-0+deb11u1 -
bullseye (security) fixed 9.0.107-0+deb11u2 -
bookworm fixed 9.0.70-2 -
trixie fixed 9.0.95-1 -
forky, sid fixed 9.0.115-1 -
(unstable) fixed 9.0.70-2 -
DLA-4244-1 DLA-4245-1 DSA-6120-1 DSA-6121-1

SUSE

Severity: High
Product Status
Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:11695 ADVISORY https://access.redhat.com/errata/RHSA-2025:11696 ADVISORY https://access.redhat.com/errata/RHSA-2025:11741 ADVISORY https://access.redhat.com/errata/RHSA-2025:11742 ADVISORY https://access.redhat.com/errata/RHSA-2025:14177 ADVISORY https://access.redhat.com/errata/RHSA-2025:14178 ADVISORY https://access.redhat.com/errata/RHSA-2025:14179 ADVISORY https://access.redhat.com/errata/RHSA-2025:14180 ADVISORY https://access.redhat.com/errata/RHSA-2025:14181 ADVISORY https://access.redhat.com/errata/RHSA-2025:14182 ADVISORY https://access.redhat.com/errata/RHSA-2025:14183 ADVISORY https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b ADVISORY https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497 ADVISORY https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93 ADVISORY https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-48976 ADVISORY https://security-tracker.debian.org/tracker/dla-4244-1 ADVISORY https://security-tracker.debian.org/tracker/dla-4245-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6120-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-6121-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02159/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02184/ REF http://www.openwall.com/lists/oss-security/2025/06/16/4 REF https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html REF https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy