CVE-2025-48976

Published: Jun 16, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Affected (7)

Products: Apache: Commons Fileupload

Apache

1 product

Commons Fileupload

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Apache Commons Fileupload	From 1.0 to 1.6
Apache Commons Fileupload	Version 2.0.0 m1-rc1
Apache Commons Fileupload	Version 2.0.0 m1
Apache Commons Fileupload	Version 2.0.0 m2-rc1
Apache Commons Fileupload	Version 2.0.0 m2
Apache Commons Fileupload	Version 2.0.0 m3-rc1
Apache Commons Fileupload	Version 2.0.0 m3

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/06/16/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.