Vulnerability · Published Jun 16, 2025 · Assigned by apache
CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
High 7.5
In plain English
A high-severity resource allocation without limits in Apache Commons FileUpload from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 32.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)32.9%top 1.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tomcat | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.87-1.el8_10.6 | ALSA-2025:14177 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.87-3.el9_6.3 | ALSA-2025:14181 |
| AlmaLinux:10 | tomcat9 | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-admin-webapps | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-docs-webapp | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-el-3.0-api | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-jsp-2.3-api | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-lib | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-servlet-4.0-api | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| AlmaLinux:10 | tomcat9-webapps | 1:9.0.87-5.el10_0.3 | ALSA-2025:14178 |
| Debian:12 | libcommons-fileupload-java | no fix listed | DEBIAN-CVE-2025-48976 |
| Debian:13 | libcommons-fileupload-java | no fix listed | DEBIAN-CVE-2025-48976 |
| Debian:14 | libcommons-fileupload-java | 1.6.0-1 | DEBIAN-CVE-2025-48976 |
| Debian:12 | tomcat10 | 10.1.52-1~deb12u1 | DEBIAN-CVE-2025-48976 |
| Debian:12 | tomcat10 | 10.1.52-1~deb12u1 | DSA-6120-1 |
| Debian:13 | tomcat10 | 10.1.52-1~deb13u1 | DSA-6120-1 |
| Debian:13 | tomcat10 | 10.1.52-1~deb13u1 | DEBIAN-CVE-2025-48976 |
| Debian:14 | tomcat10 | 10.1.46-1 | DEBIAN-CVE-2025-48976 |
| Debian:13 | tomcat11 | 11.0.15-1~deb13u1 | DSA-6121-1 |
| Debian:13 | tomcat11 | 11.0.15-1~deb13u1 | DEBIAN-CVE-2025-48976 |
| Debian:14 | tomcat11 | 11.0.11-1 | DEBIAN-CVE-2025-48976 |
| Debian:12 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2025-48976 |
| Debian:13 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2025-48976 |
| Debian:14 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2025-48976 |
| Maven | commons-fileupload:commons-fileupload | 1.6.0 | GHSA-vv7r-c36w-3prj |
| Maven | org.apache.commons:commons-fileupload2-core | 2.0.0-M4 | GHSA-vv7r-c36w-3prj |
| Rocky Linux:10 | tomcat | 1:10.1.36-1.el10_0.2 | RLSA-2025:14179 |
| Rocky Linux:8 | tomcat | 1:9.0.87-1.el8_10.6 | RLSA-2025:14177 |
| Rocky Linux:9 | tomcat | 1:9.0.87-3.el9_6.3 | RLSA-2025:14181 |
| Rocky Linux:10 | tomcat9 | 1:9.0.87-5.el10_0.3 | RLSA-2025:14178 |
| Ubuntu:22.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:24.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:25.10 | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:26.04:LTS | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:26.10 | libcommons-fileupload-java | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:24.04:LTS | tomcat10 | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:25.10 | tomcat10 | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:26.04:LTS | tomcat10 | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:26.10 | tomcat10 | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:25.10 | tomcat11 | no fix listed | UBUNTU-CVE-2025-48976 |
| Ubuntu:26.04:LTS | tomcat11 | no fix listed | UBUNTU-CVE-2025-48976 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons FileUpload | 1.0 – before 1.6 |
| Apache Software Foundation | Apache Commons FileUpload | 2.0.0-M1 – before 2.0.0-M4 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H