{"id":"CVE-2014-0050","aliases":["CLSA-2026-1779324465","CLSA-2026-1779410882","DEBIAN-CVE-2014-0050","DSA-2856-1","DSA-2897-1","EUVD-2018-0825","GHSA-xx68-jfcg-xmmf","MGASA-2014-0109","MGASA-2014-0110","RHSA-2014:0253","RHSA-2014:0429","RHSA-2014:0525","RHSA-2014:0526","UBUNTU-CVE-2014-0050","openSUSE-SU-2024:10262-1","openSUSE-SU-2024:10446-1","openSUSE-SU-2024:10620-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Commons FileUpload Denial of service vulnerability","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.83334,"percentile":0.99683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-264","CWE-835"],"published":"2014-02-07T00:00:00Z","modified":"2026-10-23T16:01:06Z","exploits":[{"source":"exploitdb","id":"EDB-31615","title":"Apache Commons FileUpload and Apache Tomcat - Denial of Service","type":"dos","platform":"multiple","date":"2014-02-12","verified":true,"url":"https://www.exploit-db.com/exploits/31615"},{"source":"pocgithub","id":"jrrdev/cve-2014-0050","title":"jrrdev/cve-2014-0050","date":"2017-03-15","url":"https://github.com/jrrdev/cve-2014-0050"},{"source":"metasploit","id":"auxiliary/dos/http/apache_commons_fileupload_dos","title":"Apache Commons FileUpload and Apache Tomcat DoS","type":"auxiliary","date":"2014-02-06","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/dos/http/apache_commons_fileupload_dos"}],"fixes":[{"ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["8.0.3","7.0.52"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libcommons-fileupload-java","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-fileupload-java","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-fileupload-java","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libcommons-fileupload-java","fixed_in":["1.2.2-1+deb6u2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libcommons-fileupload-java","fixed_in":["1.2.2-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"apache-commons-fileupload","fixed_in":["1.2.2-10.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"apache-commons-fileupload","fixed_in":["1.3-5.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"tomcat","fixed_in":["7.0.41-5.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"tomcat","fixed_in":["7.0.47-1.2.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","fixed_in":["0:7.3.0-2.Final_redhat_2.1.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","fixed_in":["0:7.3.0-2.Final_redhat_2.1.ep6.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-RC1"},{"last_affected":"8.0.1"},{"fixed":"8.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.50"},{"fixed":"7.0.52"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"1.2.2-tuxcare.3"}]}],"versions":["1.2.2","1.2.2-tuxcare.1","1.2.2-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.2.1-tuxcare.3"}]}],"versions":["1.2.1","1.2.1-tuxcare.1","1.2.1-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1+deb6u2"}]}],"versions":["1.2.2-1"]},{"source":"osv","ecosystem":"Debian:7","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1+deb7u2"}]}],"versions":["1.2.2-1","1.2.2-1+deb7u1"]},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u1"}]}],"versions":["7.0.28-4"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1"}]}],"versions":["1.0","1.0-beta-1","1.0-rc1","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-RC1"},{"fixed":"8.0.3"}]}],"versions":["8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.52"}]}],"versions":["7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50"]},{"source":"osv","ecosystem":"Mageia:3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-10.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3-5.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.41-5.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.47-1.2.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-2.Final_redhat_2.1.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.0-2.Final_redhat_2.1.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-64.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-19_patch_04.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-27_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-13_patch_02.ep6.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_02.ep6.el6"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.36-3.3"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1.9"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"commons_fileupload"},{"vendor":"apache","product":"tomcat"},{"vendor":"oracle","product":"retail_applications"}],"references":[{"url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0008.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676656","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://jvn.jp/en/jp/JVN14876762/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=143136844732487\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://secunia.com/advisories/60753","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1062337","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"http://secunia.com/advisories/59184","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677691","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2856","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59039","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59185","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676401","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0012.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/58075","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676853","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59187","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59041","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676092","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21681214","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0007.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/60475","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/r1565143","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0110.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory","web"]},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676410","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676405","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://secunia.com/advisories/59492","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59500","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59183","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676403","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0252.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2130-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/65400","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0400.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59725","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675432","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/57915","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59399","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676091","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/58976","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0253.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59232","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory","web"]},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677724","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/532549/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669554","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202107-39","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0050","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xx68-jfcg-xmmf","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907@apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/29384723d8d9645b87e05be9fa369a4deeb78b9c","tags":["web"]},{"url":"https://svn.apache.org/viewvc?view=revision\u0026revision=1565143","tags":["web"]},{"url":"https://svn.apache.org/viewvc?view=revision\u0026revision=1565163","tags":["web"]},{"url":"https://svn.apache.org/viewvc?view=revision\u0026revision=1565169","tags":["web"]},{"url":"https://tomcat.apache.org/security-7.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://github.com/apache/commons-fileupload/commit/c61ff05b3241cb14d989b67209e57aa71540417a","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0050","tags":["advisory"]},{"url":"https://github.com/apache/commons-fileupload","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0109.html","tags":["advisory"]},{"url":"http://seclists.org/fulldisclosure/2014/Feb/41","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128499.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12653","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0110.html","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.52","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12899","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0253","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0253.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0050","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0429","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-6.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1069905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1069921","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0429.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4286","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4286","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4322","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0525","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1069919","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0525.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0033","tags":["advisory"]},{"url":"https://access.redhat.com/site/solutions/88203","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0526","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0526.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0050","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2130-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2014-03-28T19:00:00Z","modified":"2026-10-07T17:58:00.799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:33:46.955592Z"}],"euvd":[{"id":"EUVD-2018-0825","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2014-03-28T19:00:00Z","modified":"2026-10-07T17:58:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-xx68-jfcg-xmmf","title":"Commons FileUpload Denial of service vulnerability","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2018-12-21T17:51:42Z","modified":"2024-03-05T19:13:46Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2014-04-01T06:27:51.373Z","modified":"2026-10-07T18:17:05.247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264","CWE-835"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"DEBIAN-CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2014-04-01T06:27:51.373Z","modified":"2026-10-23T16:01:06.201852583Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"CLSA-2026-1779324465","title":"TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.2.2-tuxcare.3.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:45:17.28745386Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779410882","title":"TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.2.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:45:16.927792014Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2014-04-01T06:27:51Z","modified":"2026-04-16T06:22:18.064242693Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DSA-2856-1","title":"libcommons-fileupload-java - security update","status":"published","published":"2014-02-07T00:00:00Z","modified":"2026-03-09T01:21:56.356378Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-2897-1","title":"tomcat7 - security update","status":"published","published":"2014-04-08T00:00:00Z","modified":"2026-03-09T01:18:45.204972Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-xx68-jfcg-xmmf","title":"Commons FileUpload Denial of service vulnerability","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"published","published":"2018-12-21T17:51:42Z","modified":"2024-12-02T05:45:08.176178Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2014-0109","title":"Updated apache-commons-fileupload package fixes CVE-2014-0050","description":"Updated apache-commons-fileupload packages fix security vulnerability:\n\nIt was discovered that the Apache Commons FileUpload package for Java could\nenter an infinite loop while processing a multipart request with a crafted\nContent-Type, resulting in a denial-of-service condition (CVE-2014-0050).\n","status":"published","published":"2014-02-28T18:57:52Z","modified":"2026-04-16T06:25:51.501454594Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0110","title":"Updated tomcat packages fix CVE-2014-0050","description":"Updated tomcat packages fix security vulnerability:\n\nIt was discovered that the Apache Commons FileUpload package for Java could\nenter an infinite loop while processing a multipart request with a crafted\nContent-Type, resulting in a denial-of-service condition (CVE-2014-0050).\n\nTomcat 7 includes an embedded copy of the Apache Commons FileUpload package,\nand was affected as well.\n","status":"published","published":"2014-02-28T18:59:29Z","modified":"2026-04-16T06:25:47.318590565Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10262-1","title":"jakarta-commons-fileupload-1.1.1-125.11 on GA media","description":"These are all security issues fixed in the jakarta-commons-fileupload-1.1.1-125.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:40.422547Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10446-1","title":"tomcat-8.0.36-3.3 on GA media","description":"These are all security issues fixed in the tomcat-8.0.36-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:08.859786Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10620-1","title":"apache-commons-fileupload-1.4-1.9 on GA media","description":"These are all security issues fixed in the apache-commons-fileupload-1.4-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:08:09.026248Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RHSA-2014:0253","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update","status":"published","published":"2024-09-15T21:08:27Z","modified":"2026-08-05T10:02:26Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0429","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T21:27:46Z","modified":"2026-08-05T10:02:32Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0525","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update","status":"published","published":"2024-09-15T21:33:18Z","modified":"2026-08-05T10:02:34Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0526","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat7 security update","status":"published","published":"2024-09-15T21:28:05Z","modified":"2026-08-05T10:02:34Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","status":"withdrawn","published":"2014-02-07T00:00:00Z","modified":"2026-02-04T03:38:08.885006Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}