Description
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-fileupload-java | 1.3.2-1 | — |
| Debian 13 | libcommons-fileupload-java | 1.3.2-1 | — |
| Debian 12 | libcommons-fileupload-java | 1.3.2-1 | — |
| Debian 8 | libcommons-fileupload-java | 1.3.1-1+deb8u1 | DSA-3611-1 |
| Debian 8 | tomcat7 | 7.0.56-3+deb8u3 | DSA-3614-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u2 | DSA-3609-1 |
| Debian 7 | libcommons-fileupload-java | 1.2.2-1+deb7u3 | DLA-528-1 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u5 | DLA-529-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libcommons-fileupload-java | 1.3.1-2ubuntu0.1 | — |
| Ubuntu 16.04 LTS | tomcat7 | 7.0.68-1ubuntu0.1 | USN-3024-1 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.1 | USN-3027-1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.6 | USN-3024-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | tomcat6 | 6.0.39-1ubuntu0.1+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.69-10.el7 | RHSA-2016:2599 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | hibernate4-eap6 +4 | 4.2.23-1.Final_redhat_1.1.ep6.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-apache-commons-daemon | 1.0.15-1.redhat_2.1.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.0.15-17.redhat_2.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | jbcs-httpd24-runtime | 1-3.jbcs.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | mod_cluster +2 | 1.3.5-2.Final_redhat_2.1.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-9.redhat_9.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat-vault | 1.0.8-9.Final_redhat_2.1.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-16.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-17.ep7.el6 | RHSA-2017:0456, RHSA-2017:0455 |
| Red Hat JBoss Web Server 2 | tomcat7 +10 | 7.0.54-23_patch_05.ep6.el6 | RHSA-2016:2807 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-4.SP3_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-16.SP14_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.11-1.Final_redhat_1.ep6.el6 | RHSA-2016:2072 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.13-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.5.11-2.Final_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.35-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.19-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
| Red Hat JBoss EAP 6 | picketlink-bindings +1 | 2.5.4-13.SP11_redhat_1.1.ep6.el5 | RHSA-2016:2070, RHSA-2016:2069, RHSA-2016:2068 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 | SUSE-SU-2023:0730-1 |
| SLES 12 SP5 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SLES 12 SP4 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SLES 12 SP2 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SLES 12 SP1 | tomcat | 8.0.32-8.7 | SUSE-SU-2016:2188-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | tomcat | 7.0.78-7.13.4 | SUSE-SU-2017:1660-1 |
| SLES for SAP 15 SP1 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 | SUSE-SU-2023:0730-1 |
| SLES for SAP 12 SP5 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SLES for SAP 12 SP4 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SLES for SAP 12 SP1 | tomcat | 8.0.32-8.7 | SUSE-SU-2016:2188-1 |
| SLES for SAP 12 | tomcat | 7.0.78-7.13.4 | SUSE-SU-2017:1660-1 |
| SLE HPC 15 SP1 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 | SUSE-SU-2023:0730-1 |
| SUSE OpenStack Cloud Crowbar 9 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
| SUSE OpenStack Cloud 9 | jakarta-commons-fileupload | 1.1.1-122.8.1 | SUSE-SU-2023:0758-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 8.0.36-3.3 | openSUSE-SU-2024:10446-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
| openSUSE Leap 15.4 | jakarta-commons-fileupload | 1.1.1-150000.4.8.1 | SUSE-SU-2023:0730-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.69-10.el7 | ELSA-2016-2599 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | < 1.3.2 | 1.3.2 | GHSA-fvm3-cfvj-gxqq |
Advisories 25
- USN-3024-1 tomcat6, tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- RHSA-2016:2599 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- USN-3027-1 tomcat8 vulnerability Ubuntu Security Notices (USN) · Oct 8, 2026
- RHSA-2017:0456 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2017:0455 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2807 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7 Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2072 Red Hat Security Advisory: jboss-ec2-eap security and enhancement update for EAP 6.4.11 Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2070 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 5 Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2069 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2016:2068 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2026-0915 Kyocera Drucker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- DSA-3614-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-529-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-528-1 libcommons-fileupload-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3611-1 libcommons-fileupload-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3609-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:2188-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0758-1 Security update for jakarta-commons-fileupload SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10446-1 tomcat-8.0.36-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1660-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0730-1 Security update for jakarta-commons-fileupload SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-0644 Apache Tomcat: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 16, 2023
- ELSA-2016-2599 Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016
References
- JVNDB-2016-000121 third-party-advisory
- https://security.netapp.com/advisory/ntap-20190212-0001/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759
- http://svn.apache.org/viewvc?view=revision&revision=1743480
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- GLSA-201705-09 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1743738
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840
- http://tomcat.apache.org/security-9.html
- USN-3024-1 vendor-advisory
- RHSA-2016:2069 vendor-advisory
- 1037029 vdb-entry
- RHSA-2016:2068 vendor-advisory
- http://tomcat.apache.org/security-7.html
- 1036900 vdb-entry
- 91453 vdb-entry
- http://tomcat.apache.org/security-8.html
- RHSA-2016:2072 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://svn.apache.org/viewvc?view=revision&revision=1743722
- DSA-3611 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371
- RHSA-2016:2807 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- openSUSE-SU-2016:2252 vendor-advisory
- JVN#89379547 third-party-advisory
- 1036427 vdb-entry
- RHSA-2016:2070 vendor-advisory
- RHSA-2017:0457 vendor-advisory
- RHSA-2016:2808 vendor-advisory
- 1039606 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1743742
- RHSA-2016:2599 vendor-advisory
- DSA-3609 vendor-advisory
- RHSA-2017:0455 vendor-advisory
- DSA-3614 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [dev] 20160621 CVE-2016-3092: Apache Commons Fileupload information disclosure vulnerability mailing-list
- RHSA-2017:0456 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1349468
- RHSA-2016:2071 vendor-advisory
- USN-3027-1 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- GLSA-202107-39 vendor-advisory