Description
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons FileUpload | 1.0 – < 1.6, 2.0.0-M1 – < 2.0.0-M4 | 1.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-fileupload-java | 1.6.0-1 | — |
| Debian 14 | tomcat10 | 10.1.46-1 | — |
| Debian 14 | tomcat11 | 11.0.11-1 | — |
| Debian 14 | tomcat9 | 9.0.70-2 | — |
| Debian 13 | libcommons-fileupload-java | No fix yet | — |
| Debian 13 | tomcat10 | 10.1.52-1~deb13u1 | DSA-6120-1 |
| Debian 13 | tomcat11 | 11.0.15-1~deb13u1 | DSA-6121-1 |
| Debian 13 | tomcat9 | 9.0.70-2 | — |
| Debian 12 | libcommons-fileupload-java | No fix yet | — |
| Debian 12 | tomcat10 | 10.1.52-1~deb12u1 | DSA-6120-1 |
| Debian 12 | tomcat9 | 9.0.70-2 | — |
| Debian 11 | libcommons-fileupload-java | 1.4-1+deb11u1 | DLA-4245-1 |
| Debian 11 | tomcat9 | 9.0.107-0+deb11u1 | DLA-4244-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | tomcat10 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | tomcat10 +1 | No fix yet | — |
| Ubuntu 25.10 | tomcat10 +2 | No fix yet | — |
| Ubuntu 24.04 LTS | tomcat10 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | libcommons-fileupload-java | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libcommons-fileupload-java | No fix yet | — |
| Ubuntu 18.04 LTS | libcommons-fileupload-java | No fix yet | — |
| Ubuntu 16.04 LTS | libcommons-fileupload-java | No fix yet | — |
| Ubuntu Pro 22.04 LTS | tomcat9 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | tomcat9 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | tomcat9 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tomcat6 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | tomcat +7 | 1:10.1.36-1.el10_0.2 | RHSA-2025:14179 |
| RHEL 10 | tomcat9 +7 | 1:9.0.87-5.el10_0.3 | RHSA-2025:14178 |
| RHEL 9 | tomcat +7 | 1:9.0.87-3.el9_6.3 | RHSA-2025:14181 |
| RHEL 8 | tomcat +7 | 1:9.0.87-1.el8_10.6 | RHSA-2025:14177 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | tomcat +7 | 1:9.0.87-1.el9_4.6 | RHSA-2025:14180 |
| RHEL 9.2 E4S | tomcat +7 | 1:9.0.87-1.el9_2.6 | RHSA-2025:14183 |
| RHEL 8.8 TUS | tomcat +7 | 1:9.0.87-1.el8_8.7 | RHSA-2025:14182 |
| RHEL 8.8 E4S | tomcat +7 | 1:9.0.87-1.el8_8.7 | RHSA-2025:14182 |
| Red Hat JBoss Web Server 6 | jws6-tomcat +9 | 10.1.36-7.redhat_00008.1.el8jws | RHSA-2025:11741 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +11 | 9.0.87-12.redhat_00011.1.el7jws | RHSA-2025:11695 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | tomcat9 +7 | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux 9 | tomcat +7 | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux 8 | tomcat +7 | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | tomcat | 1:10.1.36-1.el10_0.2 | RLSA-2025:14179 |
| Rocky Linux 10 | tomcat9 | 1:9.0.87-5.el10_0.3 | RLSA-2025:14178 |
| Rocky Linux 9 | tomcat | 1:9.0.87-3.el9_6.3 | RLSA-2025:14181 |
| Rocky Linux 8 | tomcat | 1:9.0.87-1.el8_10.6 | RLSA-2025:14177 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES 15 SP6 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES 15 SP5 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES 15 SP4 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES 15 SP3 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | jakarta-commons-fileupload | 1.6.0-126.3.1 | SUSE-SU-2025:02184-1 |
| SLES for SAP 15 SP5 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES for SAP 15 SP4 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLES for SAP 15 SP3 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLE HPC 15 SP5 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLE HPC 15 SP4 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SLE HPC 15 SP3 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SUSE Manager Server 4.3 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
| SUSE Enterprise Storage 7.1 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-fileupload | 1.6.0-1.1 | openSUSE-SU-2025:15208-1 |
| openSUSE Leap 15.6 | apache-commons-fileupload | 1.6.0-150200.3.12.1 | SUSE-SU-2025:02159-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tomcat10 +7 | 1:10.1.42-1.amzn2023.0.1 | ALAS2023-2025-1064 |
| Amazon Linux 2023 | tomcat9 +7 | 1:9.0.106-1.amzn2023.0.1 | ALAS2023-2025-1065 |
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.12 | ALAS2-2025-2920 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | tomcat +7 | 1:10.1.36-1.el10_0.2 | ELSA-2025-14179 |
| Oracle Linux 10 | tomcat9 +7 | 1:9.0.87-5.el10_0.3 | ELSA-2025-14178 |
| Oracle Linux 9 | tomcat +7 | 1:9.0.87-3.el9_6.3 | ELSA-2025-14181 |
| Oracle Linux 8 | tomcat +7 | 1:9.0.87-1.el8_10.6 | ELSA-2025-14177 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jenkins-2 +6 | 2.515-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
nankuo/CVE-2025-48976_CVE-2025-48988 ★ 2 · Jun 23, 2025
CVE-2025-48976_CVE-2025-48988
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-fileupload:commons-fileupload | >= 1.0, < 1.6.0 | 1.6.0 | GHSA-vv7r-c36w-3prj |
| Maven | org.apache.commons:commons-fileupload2-core | >= 2.0.0-M1, < 2.0.0-M4 | 2.0.0-M4 | GHSA-vv7r-c36w-3prj |
Advisories 50
- ALSA-2025:14181 Important: tomcat security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:14178 Important: tomcat9 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:14177 Important: tomcat security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:14183 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14181 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14182 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14179 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14180 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14177 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:14178 Red Hat Security Advisory: tomcat9 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:11695 Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:11741 Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
- WID-SEC-2026-1118 Dell PowerProtect Data Domain OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 5, 2026
- WID-SEC-2026-2438 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2025-1334 Apache Commons FileUpload: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 12, 2026
- WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- openSUSE-SU-2025:15208-1 apache-commons-fileupload-1.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02184-1 Security update for jakarta-commons-fileupload SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2026-0177 Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
- WID-SEC-2026-0438 Atlassian Bamboo und Confluence (Data Center und Server): Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 17, 2026
- DSA-6120-1 tomcat10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4245-1 libcommons-fileupload-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4244-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-6121-1 tomcat11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02159-1 Security update for apache-commons-fileupload SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0034 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Jan 22, 2026
- NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0175 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0165 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2853 HCL Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2025
- NCSC-2025-0395 Kwetsbaarheden verholpen in SAP Software NCSC-NL (Netherlands) · Dec 12, 2025
- WID-SEC-2025-2768 SAP Patchday Dezember 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 8, 2025
- WID-SEC-2025-2359 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 23, 2025
- NCSC-2025-0334 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Nov 21, 2025
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0336 Kwetsbaarheden verholpen in Oracle Hyperion NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0335 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0333 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0332 Kwetsbaarheden verholpen in Oracle Enterprise Manager NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0329 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0328 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2356 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2025
References
- https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 vendor-advisory