Description
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-fileupload-java | 1.3.1-1 | — |
| Debian 13 | libcommons-fileupload-java | 1.3.1-1 | — |
| Debian 12 | libcommons-fileupload-java | 1.3.1-1 | — |
| Debian 7 | libcommons-fileupload-java | 1.2.2-1+deb7u2 | DSA-2856-1 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u1 | DSA-2897-1 |
| Debian 6.0 | libcommons-fileupload-java | 1.2.2-1+deb6u2 | DSA-2856-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-64.el6_5 | RHSA-2014:0429 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | tomcat6 +9 | 6.0.37-19_patch_04.ep6.el5 | RHSA-2014:0525 |
| Red Hat JBoss Web Server 2 | tomcat7 +9 | 7.0.40-9_patch_02.ep6.el6 | RHSA-2014:0526 |
| Red Hat JBoss EAP 6 | jbossweb | 7.3.0-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:0253 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-fileupload | 1.4-1.9 | openSUSE-SU-2024:10620-1 |
| openSUSE Tumbleweed | tomcat | 8.0.36-3.3 | openSUSE-SU-2024:10446-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Commons FileUpload and Apache Tomcat DoS
auxiliary/dos/http/apache_commons_fileupload_dos
Exploit-DB 1
- Apache Commons FileUpload and Apache Tomcat - Denial of Service EDB-31615 · dos · Feb 12, 2014 · verified
GitHub 1 repository
-
jrrdev/cve-2014-0050 ★ 1 · Mar 15, 2017
CVE-2014-0050 Vulnerable site sample
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | < 1.3.1 | 1.3.1 | GHSA-xx68-jfcg-xmmf |
| Maven | org.apache.tomcat:tomcat | >= 8.0.0-RC1, < 8.0.3 | 8.0.3 | GHSA-xx68-jfcg-xmmf |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.52 | 7.0.52 | GHSA-xx68-jfcg-xmmf |
Advisories 10
- RHSA-2014:0525 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0526 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0429 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0253 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-0915 Kyocera Drucker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- DSA-2856-1 libcommons-fileupload-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2897-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10446-1 tomcat-8.0.36-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10620-1 apache-commons-fileupload-1.4-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21676656
- JVN#14876762 third-party-advisory
- HPSBGN03329 vendor-advisory
- 60753 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1062337
- 59184 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21677691
- DSA-2856 vendor-advisory
- 59039 third-party-advisory
- 59185 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676401
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- 58075 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676853
- 59187 third-party-advisory
- 59041 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21676092
- http://www-01.ibm.com/support/docview.wss?uid=swg21681214
- http://www.vmware.com/security/advisories/VMSA-2014-0007.html
- 60475 third-party-advisory
- http://svn.apache.org/r1565143
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
- http://advisories.mageia.org/MGASA-2014-0110.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
- MDVSA-2015:084 vendor-advisory
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21676410
- http://www-01.ibm.com/support/docview.wss?uid=swg21676405
- http://tomcat.apache.org/security-7.html
- 59492 third-party-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- 59500 third-party-advisory
- 59183 third-party-advisory
- http://tomcat.apache.org/security-8.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21676403
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- RHSA-2014:0252 vendor-advisory
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
- JVNDB-2014-000017 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- USN-2130-1 vendor-advisory
- 65400 vdb-entry
- RHSA-2014:0400 vendor-advisory
- 59725 third-party-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- http://www-01.ibm.com/support/docview.wss?uid=swg21675432
- 57915 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
- 59399 third-party-advisory
- [commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoS mailing-list
- http://www-01.ibm.com/support/docview.wss?uid=swg21676091