CVE-2025-48976

Description

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Reserved 2025-05-29 | Published 2025-06-16 | Updated 2025-06-16 | Assigner apache

Problem types

Allocation of resources with insufficient limits

Product status

Default status
unaffected

1.0 before 1.6
affected

Default status
unaffected

2.0.0-M1 before 2.0.0-M4
affected

Credits

TERASOLUNA Framework Security Team of NTT DATA Group Corporation finder

References

lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12 vendor-advisory

cve.org (CVE-2025-48976)

nvd.nist.gov (CVE-2025-48976)

Download JSON