p PatchFirst

CVE-2025-48976

CVE-2025-48976 · Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

CVSS 7.5 · High · EPSS 32.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache commons fileupload

    Versions
    • ≥ 1.0, < 1.6: Affected (semver)

    Update to 1.6

  • apache commons fileupload

    Versions
    • ≥ 2.0.0-M1, < 2.0.0-M4: Affected (semver)

    No fix published

  • libcommons-fileupload-java Debian:12

    Versions
    • 1.4-2
    • 1.5-1
    • 1.5-1.1
    • 1.6.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Debian:13

    Versions
    • 1.5-1.1
    • 1.6.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Debian:14

    Versions
    • 1.5-1.1
    Affected ranges
    • ECOSYSTEM: < 1.6.0-1

    Update to 1.6.0-1

  • tomcat10 Debian:12

    Versions
    • 10.1.10-1
    • 10.1.13-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.20-1
    • 10.1.23-1
    • 10.1.25-1
    • 10.1.25-1~bpo12+1
    • 10.1.25-2
    • 10.1.30-1
    • 10.1.30-1~bpo12+1
    • 10.1.31-1
    • 10.1.33-1
    • 10.1.33-1~bpo12+1
    • 10.1.34-0+deb12u1
    • 10.1.34-0+deb12u2
    • 10.1.34-1
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1~bpo12+1
    • 10.1.46-1
    • 10.1.6-1
    • 10.1.6-1+deb12u1
    • 10.1.6-1+deb12u2
    • 10.1.7-1
    • 10.1.8-1
    • 10.1.9-1
    Affected ranges
    • ECOSYSTEM: < 10.1.52-1~deb12u1

    Update to 10.1.52-1~deb12u1

  • tomcat10 Debian:13

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 10.1.52-1~deb13u1

    Update to 10.1.52-1~deb13u1

  • tomcat10 Debian:14

    Versions
    • 10.1.40-1
    Affected ranges
    • ECOSYSTEM: < 10.1.46-1

    Update to 10.1.46-1

  • tomcat11 Debian:13

    Versions
    • 11.0.11-1
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: < 11.0.15-1~deb13u1

    Update to 11.0.15-1~deb13u1

  • tomcat11 Debian:14

    Versions
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: < 11.0.11-1

    Update to 11.0.11-1

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:16.04:LTS

    Versions
    • 1.3.1-1
    • 1.3.1-2
    • 1.3.1-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:18.04:LTS

    Versions
    • 1.3.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    • 9.0.16-3ubuntu0.18.04.2+esm2
    • 9.0.16-3ubuntu0.18.04.2+esm3
    • 9.0.16-3ubuntu0.18.04.2+esm4
    • 9.0.16-3ubuntu0.18.04.2+esm5
    • 9.0.16-3ubuntu0.18.04.2+esm6
    • 9.0.16-3ubuntu0.18.04.2+esm7
    • 9.0.16-3ubuntu0.18.04.2+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:20.04:LTS

    Versions
    • 1.3.3-1
    • 1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    • 9.0.31-1ubuntu0.6
    • 9.0.31-1ubuntu0.7
    • 9.0.31-1ubuntu0.8
    • 9.0.31-1ubuntu0.9
    • 9.0.31-1ubuntu0.9+esm1
    • 9.0.31-1ubuntu0.9+esm2
    • 9.0.31-1ubuntu0.9+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:22.04:LTS

    Versions
    • 1.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    • 9.0.58-1ubuntu0.1+esm2
    • 9.0.58-1ubuntu0.1+esm3
    • 9.0.58-1ubuntu0.1+esm4
    • 9.0.58-1ubuntu0.2
    • 9.0.58-1ubuntu0.2+esm1
    • 9.0.58-1ubuntu0.2+esm2
    • 9.0.58-1ubuntu0.2+esm3
    • 9.0.58-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:24.04:LTS

    Versions
    • 1.4-2
    • 1.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:24.04:LTS

    Versions
    • 10.1.10-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.16-1ubuntu0.1~esm1
    • 10.1.16-1ubuntu0.1~esm2
    • 10.1.16-1ubuntu0.1~esm3
    • 10.1.16-1ubuntu0.1~esm4
    • 10.1.55-1ubuntu2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libcommons-fileupload-java Ubuntu:25.10

    Versions
    • 1.5-1
    • 1.5-1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →