PT-2025-25565 · Apache+10 · Apache Commons Fileupload+12
CVE-2025-48976
·
Published
2025-01-01
·
Updated
2026-06-17
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Apache Commons FileUpload versions 1.0 through 1.5
Apache Commons FileUpload versions 2.0.0-M1 through 2.0.0-M3
Description
The issue is related to the allocation of resources for multipart headers with insufficient limits, which enables a Denial of Service (DoS) vulnerability in Apache Commons FileUpload. A specially crafted request that uses a large number of parts with large headers could trigger excessive memory usage leading to a DoS. The limit for the size of the headers associated with a multipart request is now configurable with a default of 512 bytes.
Recommendations
For Apache Commons FileUpload versions 1.0 through 1.5, upgrade to version 1.6.
For Apache Commons FileUpload versions 2.0.0-M1 through 2.0.0-M3, upgrade to version 2.0.0-M4.
As a temporary workaround, consider configuring the maxPartHeaderSize on the Connector to a suitable value to minimize the risk of exploitation.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Commons Fileupload
Apache Tomcat
Astra Linux
Bamboo
Centos
Confluence
Debian
Red Hat
Red Os
Rocky Linux
Suse