CVE-2014-0050
Commons FileUpload Denial of service vulnerability
7.5 HighPublic exploitFix available
CVE-2014-0050 is a high vulnerability (CVSS 7.5) in Apache Commons Fileupload, published February 7, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 83.3%, the 99th percentile. Fixed in commons-fileupload:commons-fileupload 1.3.1.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 83.3%EPSS, 99th percentile
- Exploitation
- None known3 public exploits
- Fixed in
1.3.1commons-fileupload:commons-fileupload +98 more
Description
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Exploit likelihood
83.3%Down 7.9 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
commons-fileupload:commons-fileuploadMaven | before 1.3.1 | 1.3.1 |
org.apache.tomcat:tomcatMaven | 8.0.0-RC1 to 8.0.1 | 8.0.3 |
org.apache.tomcat:tomcatMaven | 7.0.0 to 7.0.50 | 7.0.52 |
commons-fileupload:commons-fileuploadTuxCare:Maven From an advisory covering 2 CVEs | 1.2.2 up to 1.2.2-tuxcare.3, plus listed versions 1.2.2-tuxcare.11.2.2-tuxcare.2 | 1.2.2-tuxcare.3 |
commons-fileupload:commons-fileuploadTuxCare:Maven From an advisory covering 2 CVEs | 1.2.1 up to 1.2.1-tuxcare.3, plus listed versions 1.2.1-tuxcare.11.2.1-tuxcare.2 | 1.2.1-tuxcare.3 |
libcommons-fileupload-javaDebian:12 | before 1.3.1-1 | 1.3.1-1 |
libcommons-fileupload-javaDebian:13 | before 1.3.1-1 | 1.3.1-1 |
libcommons-fileupload-javaDebian:14 | before 1.3.1-1 | 1.3.1-1 |
libcommons-fileupload-javaDebian:6.0 | before 1.2.2-1+deb6u2, plus listed versions 1.2.2-1 | 1.2.2-1+deb6u2 |
libcommons-fileupload-javaDebian:7 | before 1.2.2-1+deb7u2, plus listed versions 1.2.2-11.2.2-1+deb7u1 | 1.2.2-1+deb7u2 |
Show 89 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat7Debian:7 From an advisory covering 6 CVEs | before 7.0.28-4+deb7u1, plus listed versions 7.0.28-4 | 7.0.28-4+deb7u1 |
commons-fileupload:commons-fileuploadMaven | before 1.3.1, plus listed versions 1.01.0-beta-11.0-rc11.11.1.1 Show 4 moreShow less1.21.2.11.2.21.3 | 1.3.1 |
org.apache.tomcat:tomcatMaven | 8.0.0-RC1 up to 8.0.3, plus listed versions 8.0.0-RC108.0.0-RC38.0.0-RC58.0.1 | 8.0.3 |
org.apache.tomcat:tomcatMaven | 7.0.0 up to 7.0.52, plus listed versions 7.0.357.0.377.0.397.0.407.0.417.0.427.0.477.0.50 | 7.0.52 |
apache-commons-fileuploadMageia:3 | before 1.2.2-10.1.mga3 | 1.2.2-10.1.mga3 |
apache-commons-fileuploadMageia:4 | before 1.3-5.1.mga4 | 1.3-5.1.mga4 |
tomcatMageia:3 | before 7.0.41-5.mga3 | 7.0.41-5.mga3 |
tomcatMageia:4 | before 7.0.47-1.2.mga4 | 7.0.47-1.2.mga4 |
jbosswebRed Hat:jboss_enterprise_application_platform:6::el5 | before 0:7.3.0-2.Final_redhat_2.1.ep6.el5 | 0:7.3.0-2.Final_redhat_2.1.ep6.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:6::el6 | before 0:7.3.0-2.Final_redhat_2.1.ep6.el6 | 0:7.3.0-2.Final_redhat_2.1.ep6.el6 |
tomcat6Red Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs | before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs | before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs | before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs | before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcatopenSUSE:Tumbleweed From an advisory covering 10 CVEs | before 8.0.36-3.3 | 8.0.36-3.3 |
apache-commons-fileuploadopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.4-1.9 | 1.4-1.9 |
tomcat10openSUSE:Tumbleweed From an advisory covering 49 CVEs | before 10.1.14-1.1 | 10.1.14-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Commons FileUpload and Apache Tomcat - Denial of Service | 2014-02-12 |
| PoC in GitHub | jrrdev/cve-2014-0050 | 2017-03-15 |
| Metasploit | Apache Commons FileUpload and Apache Tomcat DoS | 2014-02-06 |
What each source reports
CVE List
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
CVE-2014-0050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2018-0825
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
EUVD-2018-0825- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xx68-jfcg-xmmfNo score
Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
GHSA-xx68-jfcg-xmmf- Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
CVE-2014-0050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264, CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0050
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
DEBIAN-CVE-2014-0050- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779324465No score
TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)
TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.2.2-tuxcare.3.
- Record
CLSA-2026-1779324465- Updated
- 2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1779410882No score
TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)
TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.2.1-tuxcare.3.
- Record
CLSA-2026-1779410882- Updated
- 2026-11-02
OSVNo score
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
CVE-2014-0050- Updated
- 2026-11-02
OSVGHSA-xx68-jfcg-xmmfNo score
Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
GHSA-xx68-jfcg-xmmf- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2014-0109No score
Updated apache-commons-fileupload package fixes CVE-2014-0050
Updated apache-commons-fileupload packages fix security vulnerability:
It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).
- Record
MGASA-2014-0109- Updated
- 2026-11-02
OSVMGASA-2014-0110No score
Updated tomcat packages fix CVE-2014-0050
Updated tomcat packages fix security vulnerability:
It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition (CVE-2014-0050).
Tomcat 7 includes an embedded copy of the Apache Commons FileUpload package, and was affected as well.
- Record
MGASA-2014-0110- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10262-1No score
jakarta-commons-fileupload-1.1.1-125.11 on GA media
These are all security issues fixed in the jakarta-commons-fileupload-1.1.1-125.11 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10262-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10446-1No score
tomcat-8.0.36-3.3 on GA media
These are all security issues fixed in the tomcat-8.0.36-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10446-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10620-1No score
apache-commons-fileupload-1.4-1.9 on GA media
These are all security issues fixed in the apache-commons-fileupload-1.4-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10620-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13441-1No score
tomcat10-10.1.14-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13441-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0050No score
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- Record
UBUNTU-CVE-2014-0050- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html
vmware.com/security/advisories/VMSA-2014-0008.html
www-01.ibm.com/support/docview.wss?uid=swg21676656
jvn.jp/en/jp/JVN14876762/index.html
marc.info?l=bugtraq&m=143136844732487&w=2
secunia.com/advisories/60753
Show 155 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1062337
debian.org/security/2014/dsa-2856
svn.apache.org/r1565143
oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
advisories.mageia.org/MGASA-2014-0110.html
blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
mandriva.com/security/advisories?name=MDVSA-2015:084
hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
tomcat.apache.org/security-7.html
securityfocus.com/archive/1/534161/100/0/threaded
rhn.redhat.com/errata/RHSA-2014-0252.html
huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
jvndb.jvn.jp/jvndb/JVNDB-2014-000017
ubuntu.com/usn/USN-2130-1
seclists.org/fulldisclosure/2014/Dec/23
mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
security.gentoo.org/glsa/202107-39
nvd.nist.gov/vuln/detail/CVE-2014-0050
github.com/advisories/GHSA-xx68-jfcg-xmmf
security-tracker.debian.org/tracker/CVE-2014-0050
lists.fedoraproject.org/pipermail/package-announce/2014-February/128499.html
bugs.mageia.org/show_bug.cgi?id=12653
access.redhat.com/errata/RHSA-2014:0253
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0253.json
cve.org/CVERecord?id=CVE-2014-0050
ubuntu.com/security/CVE-2014-0050
suse.com/security/cve/CVE-2013-2186