Every CVE Search/ Get API key

CVE-2025-48976

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

7.5 HighPublic exploitFix available

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

32.9%Up 32.9 points since Jun 17, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
CVE-2025-48976
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-18407 7.5

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
EUVD-2025-18407
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-vv7r-c36w-3prj 8.7

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
GHSA-vv7r-c36w-3prj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
NVD 7.5

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
CVE-2025-48976
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV 7.5

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
CVE-2025-48976
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-48976 7.5

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
DEBIAN-CVE-2025-48976
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 37 moreShow less
OSVGHSA-vv7r-c36w-3prj 8.7

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
GHSA-vv7r-c36w-3prj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
OSVOESA-2025-1706 7.5

apache-commons-fileupload security update

The javax.servlet package lacks support for RFC-1867, HTML file upload. This package provides a simple to use API for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1706
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1765 7.5

apache-commons-fileupload security update

The javax.servlet package lacks support for RFC-1867, HTML file upload. This package provides a simple to use API for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1765
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1814 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1814
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1815 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1815
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1816 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)

Record
OESA-2025-1816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1817 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1817
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1818 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1818
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-1819 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

Record
OESA-2025-1819
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHLW-2026-44a75016eab78e73 7.5

Lightwell Security Advisory: commons-fileupload 1.4.0.rhlw-00001

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976.

CVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

This patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.4.0 from Maven Central.

Record
RHLW-2026-44a75016eab78e73
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHLW-2026-8f37e023b4e3806b 7.5

Lightwell Security Advisory: commons-fileupload 1.5.0.rhlw-00002

Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.5.0.rhlw-00002 with a backported security fix.

CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

This patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.5.0 from Maven Central.

Record
RHLW-2026-8f37e023b4e3806b
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:11695 5.3

Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update

Record
RHSA-2025:11695
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:11741 5.3

Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update

Record
RHSA-2025:11741
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:14177 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14178 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14179 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14179
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14180 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14180
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14181 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14182 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14182
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:14183 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2025:14183
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14177 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14178 7.5

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14178
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14179 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14179
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:14181 7.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)

  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)

  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:14181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-48976 7.5

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Record
UBUNTU-CVE-2025-48976
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:14177 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14177
Updated
2026-11-02
OSVALSA-2025:14178 No score

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14178
Updated
2026-11-02
OSVALSA-2025:14181 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)
  • tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
  • apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)
  • tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52520)
  • tomcat: Apache Tomcat denial of service (CVE-2025-52434)
  • tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:14181
Updated
2026-11-02
OSVCLSA-2026-1777509601 No score

TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.5-tuxcare.2.

Record
CLSA-2026-1777509601
Updated
2026-11-02
OSVCLSA-2026-1777509603 No score

TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.2-tuxcare.2.

Record
CLSA-2026-1777509603
Updated
2026-11-02
OSVCLSA-2026-1777941823 No score

TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.1-tuxcare.2.

Record
CLSA-2026-1777941823
Updated
2026-11-02
OSVCLSA-2026-1785906695 No score

TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)

TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.1.

Record
CLSA-2026-1785906695
Updated
2026-11-02
OSVMGASA-2025-0296 No score

Updated apache-commons-fileupload packages fix security vulnerability

Apache Commons FileUpload: FileUpload DoS via part headers. (CVE-2025-48976)

Record
MGASA-2025-0296
Updated
2026-11-02
OSVopenSUSE-SU-2025:15208-1 No score

apache-commons-fileupload-1.6.0-1.1 on GA media

These are all security issues fixed in the apache-commons-fileupload-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15208-1
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-48976 No score

CVE-2025-48976 in io.root.commons-fileupload:commons-fileupload - Patched by Root

Root has patched CVE-2025-48976 in the io.root.commons-fileupload:commons-fileupload package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-48976
Updated
2026-11-02
OSVSUSE-SU-2025:02159-1 No score

Security update for apache-commons-fileupload

This update for apache-commons-fileupload fixes the following issues: Upgrade to upstream version 1.6.0

  • CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient limits can lead to a DoS (bsc#1244657).

Full changelog:

https://commons.apache.org/proper/commons-fileupload/changes.html#a1.6.0

Record
SUSE-SU-2025:02159-1
Updated
2026-11-02
OSVSUSE-SU-2025:02184-1 No score

Security update for jakarta-commons-fileupload

This update for jakarta-commons-fileupload fixes the following issues:

Upgrade to upstream version 1.6.0

  • CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient limits can lead to a DoS (bsc#1244657).

Full changelog:

https://commons.apache.org/proper/commons-fileupload/changes.html#a1.6.0

Record
SUSE-SU-2025:02184-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.commons:commons-fileupload2-core
Maven
 2.0.0-M1 up to 2.0.0-M4
2.0.0-M4
commons-fileupload:commons-fileupload
Maven
 1.0 up to 1.6.0
1.6.0
tomcat
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-docs-webapp
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-servlet-4.0-api
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
AlmaLinux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
Show 219 moreShow less
Affected packages
PackageAffectedFixed
tomcat9
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
AlmaLinux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
commons-fileupload:commons-fileupload
TuxCare:Maven
 1.5 up to 1.5-tuxcare.2, plus listed versions
1.5-tuxcare.1
1.5-tuxcare.2
commons-fileupload:commons-fileupload
TuxCare:Maven
 1.2.2 up to 1.2.2-tuxcare.2, plus listed versions
1.2.2-tuxcare.1
1.2.2-tuxcare.2
commons-fileupload:commons-fileupload
TuxCare:Maven
 1.2.1 up to 1.2.1-tuxcare.2, plus listed versions
1.2.1-tuxcare.1
1.2.1-tuxcare.2
commons-fileupload:commons-fileupload
TuxCare:Maven
 1.3.1 up to 1.3.1-tuxcare.1
1.3.1-tuxcare.1
libcommons-fileupload-java
Debian:12
 All versions, plus listed versions
1.4-21.5-11.5-1.11.6.0-1
 None known
libcommons-fileupload-java
Debian:13
 All versions, plus listed versions
1.5-1.11.6.0-1
 None known
libcommons-fileupload-java
Debian:14
 before 1.6.0-1, plus listed versions
1.5-1.1
1.6.0-1
tomcat10
Debian:12
 before 10.1.52-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 23 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.52-1~deb12u1
tomcat10
Debian:13
 before 10.1.52-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u1
10.1.52-1~deb13u1
tomcat10
Debian:14
 before 10.1.46-1, plus listed versions
10.1.40-1
10.1.46-1
tomcat11
Debian:13
 before 11.0.15-1~deb13u1, plus listed versions
11.0.11-111.0.6-1
11.0.15-1~deb13u1
tomcat11
Debian:14
 before 11.0.11-1, plus listed versions
11.0.6-1
11.0.11-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:11
 before 9.0.107-0+deb11u1, plus listed versions
9.0.43-19.0.43-29.0.43-2~deb11u19.0.43-2~deb11u109.0.43-2~deb11u11
Show 25 moreShow less
9.0.43-2~deb11u129.0.43-2~deb11u29.0.43-2~deb11u39.0.43-2~deb11u49.0.43-2~deb11u59.0.43-2~deb11u69.0.43-2~deb11u79.0.43-2~deb11u89.0.43-2~deb11u99.0.43-39.0.53-19.0.54-19.0.55-19.0.58-19.0.62-19.0.63-19.0.64-19.0.64-29.0.65-19.0.67-19.0.68-19.0.68-1.19.0.70-19.0.70-29.0.95-1
9.0.107-0+deb11u1
libcommons-fileupload-java
Debian:11
 before 1.4-1+deb11u1, plus listed versions
1.4-1
1.4-1+deb11u1
commons-fileupload:commons-fileupload
Maven
 1.0 up to 1.6.0, plus listed versions
1.11.1.11.21.2.11.2.2
Show 8 moreShow less
1.31.3.11.3.1-jenkins-11.3.1-jenkins-21.3.21.3.31.41.5
1.6.0
org.apache.commons:commons-fileupload2-core
Maven
 2.0.0-M1 up to 2.0.0-M4, plus listed versions
2.0.0-M22.0.0-M3
2.0.0-M4
apache-commons-fileupload
Mageia:9
 before 1.4-5.1.mga9
1.4-5.1.mga9
apache-commons-fileupload
openEuler:22.03-LTS-SP4
 before 1.4-3.oe2203sp4
1.4-3.oe2203sp4
apache-commons-fileupload
openEuler:24.03-LTS
 before 1.4-3.oe2403sp1
1.4-3.oe2403sp1
apache-commons-fileupload
openEuler:24.03-LTS-SP1
 before 1.4-3.oe2403sp1
1.4-3.oe2403sp1
apache-commons-fileupload
openEuler:20.03-LTS-SP4
 before 1.4-3.oe2003sp4
1.4-3.oe2003sp4
apache-commons-fileupload
openEuler:22.03-LTS-SP3
 before 1.4-3.oe2203sp3
1.4-3.oe2203sp3
apache-commons-fileupload
openEuler:24.03-LTS-SP2
 before 1.4-3.oe2403sp2
1.4-3.oe2403sp2
tomcat
openEuler:24.03-LTS
 before 9.0.100-5.oe2403
9.0.100-5.oe2403
tomcat
openEuler:24.03-LTS-SP1
 before 9.0.100-5.oe2403sp1
9.0.100-5.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
 before 9.0.100-5.oe2403sp2
9.0.100-5.oe2403sp2
tomcat
openEuler:20.03-LTS-SP4
 before 9.0.100-5.oe2003sp4
9.0.100-5.oe2003sp4
tomcat
openEuler:22.03-LTS-SP3
 before 9.0.100-5.oe2203sp3
9.0.100-5.oe2203sp3
tomcat
openEuler:22.03-LTS-SP4
 before 9.0.100-5.oe2203sp4
9.0.100-5.oe2203sp4
commons-fileupload:commons-fileupload
Red Hat Lightwell:Maven
 before 1.4.0.rhlw-00001, plus listed versions
1.01.0-beta-11.0-rc11.11.1.1
Show 11 moreShow less
1.21.2.11.2.21.31.3.11.3.1-jenkins-11.3.1-jenkins-21.3.21.3.31.41.4.0
1.4.0.rhlw-00001
commons-fileupload:commons-fileupload
Red Hat Lightwell:Maven
 1.5.0 up to 1.5.0.rhlw-00002, plus listed versions
1.5
1.5.0.rhlw-00002
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk11
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-java-jdk8
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el7
 before 0:9.0.87-12.redhat_00011.1.el7jws
0:9.0.87-12.redhat_00011.1.el7jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el8
 before 0:9.0.87-12.redhat_00011.1.el8jws
0:9.0.87-12.redhat_00011.1.el8jws
jws5-tomcat
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-el-3.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-jsp-2.3-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-lib
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-selinux
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-servlet-4.0-api
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws5-tomcat-webapps
Red Hat:jboss_enterprise_web_server:5.8::el9
 before 0:9.0.87-12.redhat_00011.1.el9jws
0:9.0.87-12.redhat_00011.1.el9jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el10
 before 0:10.1.36-7.redhat_00008.1.el10jws
0:10.1.36-7.redhat_00008.1.el10jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el8
 before 0:10.1.36-7.redhat_00008.1.el8jws
0:10.1.36-7.redhat_00008.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.1::el9
 before 0:10.1.36-7.redhat_00008.1.el9jws
0:10.1.36-7.redhat_00008.1.el9jws
tomcat
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-lib
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-admin-webapps
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-docs-webapp
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-el-3.0-api
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-lib
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat9-webapps
Red Hat:enterprise_linux:10.0
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-admin-webapps
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-docs-webapp
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-el-5.0-api
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-jsp-3.1-api
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-lib
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-servlet-6.0-api
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat-webapps
Red Hat:enterprise_linux:10.0
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-admin-webapps
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-docs-webapp
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-el-3.0-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-lib
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat-webapps
Red Hat:rhel_eus:9.4::appstream
 before 1:9.0.87-1.el9_4.6
1:9.0.87-1.el9_4.6
tomcat
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-lib
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
tomcat
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-docs-webapp
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-el-3.0-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-lib
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-webapps
Red Hat:rhel_e4s:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-admin-webapps
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-docs-webapp
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-el-3.0-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-jsp-2.3-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-lib
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-servlet-4.0-api
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat-webapps
Red Hat:rhel_tus:8.8::appstream
 before 1:9.0.87-1.el8_8.7
1:9.0.87-1.el8_8.7
tomcat
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-admin-webapps
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-docs-webapp
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-lib
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat-webapps
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.87-1.el9_2.6
1:9.0.87-1.el9_2.6
tomcat
Rocky Linux:8
 before 1:9.0.87-1.el8_10.6
1:9.0.87-1.el8_10.6
tomcat9
Rocky Linux:10
 before 1:9.0.87-5.el10_0.3
1:9.0.87-5.el10_0.3
tomcat
Rocky Linux:10
 before 1:10.1.36-1.el10_0.2
1:10.1.36-1.el10_0.2
tomcat
Rocky Linux:9
 before 1:9.0.87-3.el9_6.3
1:9.0.87-3.el9_6.3
io.root.commons-fileupload:commons-fileupload
Root:Maven
 before 1.5-root.io.1
1.5-root.io.11.5-root.io.2
commons-fileupload:commons-fileupload
Root:Maven
 before 1.5-aikido.2
1.5-aikido.2
apache-commons-fileupload
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Manager Server 4.3
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
SUSE:Enterprise Storage 7.1
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
apache-commons-fileupload
openSUSE:Leap 15.6
 before 1.6.0-150200.3.12.1
1.6.0-150200.3.12.1
jakarta-commons-fileupload
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 1.6.0-126.3.1
1.6.0-126.3.1
jakarta-commons-fileupload
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.6.0-126.3.1
1.6.0-126.3.1
tomcat6
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
6.0.37-16.0.39-16.0.39-1ubuntu0.16.0.39-1ubuntu0.1+esm16.0.39-1ubuntu0.1+esm26.0.39-1ubuntu0.1+esm3
 None known
libcommons-fileupload-java
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.3.1-11.3.1-21.3.1-2ubuntu0.1
 None known
libcommons-fileupload-java
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.3.3-1
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
libcommons-fileupload-java
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.3.3-11.4-1
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
libcommons-fileupload-java
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4-1
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
libcommons-fileupload-java
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.4-21.5-1
 None known
tomcat10
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1
Show 4 moreShow less
10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1
 None known
libcommons-fileupload-java
Ubuntu:25.10
 All versions, plus listed versions
1.5-11.5-1.1
 None known
tomcat10
Ubuntu:25.10
 All versions, plus listed versions
10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1
 None known
tomcat11
Ubuntu:25.10
 All versions, plus listed versions
11.0.6-1
 None known
libcommons-fileupload-java
Ubuntu:26.10
 All versions, plus listed versions
1.5-1.1
 None known
tomcat10
Ubuntu:26.10
 All versions, plus listed versions
10.1.40-1ubuntu110.1.54-110.1.54-1ubuntu110.1.54-1ubuntu210.1.55-1ubuntu110.1.55-1ubuntu210.1.57~us1-0ubuntu1
 None known
libcommons-fileupload-java
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.5-1.1
 None known
tomcat10
Ubuntu:26.04:LTS
 All versions, plus listed versions
10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1
 None known
tomcat11
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1
 None known
apache-commons-fileupload
openSUSE:Tumbleweed
 before 1.6.0-1.1
1.6.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubnankuo/CVE-2025-48976_CVE-2025-489882025-06-23

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48976 is a high vulnerability (CVSS 7.5) in Apache Commons Fileupload, published June 16, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 32.9%, the 98th percentile. Fixed in org.apache.commons:commons-fileupload2-core 2.0.0-M4.

References

Show 100 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open