Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

HIGH 7.5CVE-2025-48976 · GHSA-vv7r-c36w-3prj · Published 16/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
commons-fileupload:commons-fileupload Maven	`≥ 1.0, < 1.6.0`	`1.6.0`
org.apache.commons:commons-fileupload2-core Maven	`≥ 2.0.0-M1, < 2.0.0-M4`	`2.0.0-M4`
commons fileupload apache	`= 2.0.0≥ 1.0, < 1.6`	`1.6`

Description

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

NVD description

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

References

nvd.nist.gov/vuln/detail/CVE-2025-48976 · ADVISORY
apache/commons-fileupload commit b247774 · WEB
apache/commons-fileupload commit bf68f63 · WEB
apache/tomcat commit 97790a3 · WEB
apache/commons-fileupload · PACKAGE
lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 · WEB
lists.debian.org/debian-lts-announce/2025/07/msg00008.html · WEB
lists.debian.org/debian-lts-announce/2025/07/msg00009.html · WEB
openwall.com/lists/oss-security/2025/06/16/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free