High severityNVD Advisory· Published Jun 16, 2025· Updated Nov 3, 2025
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
CVE-2025-48976
Description
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
commons-fileupload:commons-fileuploadMaven | >= 1.0, < 1.6.0 | 1.6.0 |
org.apache.commons:commons-fileupload2-coreMaven | >= 2.0.0-M1, < 2.0.0-M4 | 2.0.0-M4 |
Affected products
62- osv-coords61 versionspkg:apk/chainguard/geoserver-2.26pkg:apk/chainguard/geoserver-2.26-communitypkg:apk/chainguard/geoserver-2.26-dockerpkg:apk/chainguard/geoserver-2.27pkg:apk/chainguard/geoserver-2.27-communitypkg:apk/chainguard/geoserver-2.27-dockerpkg:apk/chainguard/jenkins-2pkg:apk/chainguard/jenkins-2-openjdk-17pkg:apk/chainguard/jenkins-2-openjdk-21pkg:apk/chainguard/jenkins-compatpkg:apk/chainguard/jenkins-docker-agentpkg:apk/chainguard/jenkins-docker-agent-openjdk-17pkg:apk/chainguard/jenkins-docker-agent-openjdk-21pkg:apk/chainguard/jenkins-remotingpkg:apk/chainguard/jenkins-utilspkg:apk/wolfi/jenkins-2pkg:apk/wolfi/jenkins-2-openjdk-17pkg:apk/wolfi/jenkins-2-openjdk-21pkg:apk/wolfi/jenkins-compatpkg:apk/wolfi/jenkins-docker-agentpkg:apk/wolfi/jenkins-docker-agent-openjdk-17pkg:apk/wolfi/jenkins-docker-agent-openjdk-21pkg:apk/wolfi/jenkins-remotingpkg:apk/wolfi/jenkins-utilspkg:maven/commons-fileupload/commons-fileuploadpkg:maven/org.apache.commons/commons-fileupload2-corepkg:rpm/almalinux/tomcatpkg:rpm/almalinux/tomcat9pkg:rpm/almalinux/tomcat9-admin-webappspkg:rpm/almalinux/tomcat9-docs-webapppkg:rpm/almalinux/tomcat9-el-3.0-apipkg:rpm/almalinux/tomcat9-jsp-2.3-apipkg:rpm/almalinux/tomcat9-libpkg:rpm/almalinux/tomcat9-servlet-4.0-apipkg:rpm/almalinux/tomcat9-webappspkg:rpm/almalinux/tomcat-admin-webappspkg:rpm/almalinux/tomcat-docs-webapppkg:rpm/almalinux/tomcat-el-3.0-apipkg:rpm/almalinux/tomcat-jsp-2.3-apipkg:rpm/almalinux/tomcat-libpkg:rpm/almalinux/tomcat-servlet-4.0-apipkg:rpm/almalinux/tomcat-webappspkg:rpm/opensuse/apache-commons-fileupload&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/apache-commons-fileupload&distro=openSUSE%20Tumbleweedpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP6pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/apache-commons-fileupload&distro=SUSE%20Manager%20Server%204.3pkg:rpm/suse/jakarta-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/jakarta-commons-fileupload&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
< 2.26.3-r1+ 60 more
- (no CPE)range: < 2.26.3-r1
- (no CPE)range: < 2.26.3-r1
- (no CPE)range: < 2.26.3-r1
- (no CPE)range: < 2.27.1-r1
- (no CPE)range: < 2.27.1-r1
- (no CPE)range: < 2.27.1-r1
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: < 2.515-r0
- (no CPE)range: >= 1.0, < 1.6.0
- (no CPE)range: >= 2.0.0-M1, < 2.0.0-M4
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-5.el10_0.3
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1:9.0.87-1.el8_10.6
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-1.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-150200.3.12.1
- (no CPE)range: < 1.6.0-126.3.1
- (no CPE)range: < 1.6.0-126.3.1
- Range: 2.0.0-M1
Patches
Vulnerability mechanics
References
9- github.com/advisories/GHSA-vv7r-c36w-3prjghsaADVISORY
- lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-48976ghsaADVISORY
- www.openwall.com/lists/oss-security/2025/06/16/4ghsaWEB
- github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78bghsaWEB
- github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497ghsaWEB
- github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93ghsaWEB
- lists.debian.org/debian-lts-announce/2025/07/msg00008.htmlghsaWEB
- lists.debian.org/debian-lts-announce/2025/07/msg00009.htmlghsaWEB
News mentions
0No linked articles in our index yet.