High severity · published Jun 16, 2025
CVE-2025-48976
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload
7.5
CVSS
32.9%
EPSS
No
On KEV
Description
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)32.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Commons Fileupload · Apache
1.0 before 1.6; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48976
Mailing List
https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12
Mailing List
http://www.openwall.com/lists/oss-security/2025/06/16/4
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
More from Commons Fileupload
9.8
CVE-2016-1000031
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
7.5
CVE-2023-24998
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
7.5
CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and…
7.5
CVE-2014-0050
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service…
6.8
CVE-2013-0248
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to…