{"id":"CVE-2025-48976","aliases":["ALSA-2025:14177","ALSA-2025:14178","ALSA-2025:14181","CLSA-2026-1777509601","CLSA-2026-1777509603","CLSA-2026-1777941823","CLSA-2026-1785906695","DEBIAN-CVE-2025-48976","DLA-4244-1","DLA-4245-1","DSA-6120-1","DSA-6121-1","EUVD-2025-18407","GHSA-hfrx-6qgj-fp6c","GHSA-vv7r-c36w-3prj","MGASA-2025-0296","OESA-2025-1706","OESA-2025-1765","OESA-2025-1814","OESA-2025-1815","OESA-2025-1816","OESA-2025-1817","OESA-2025-1818","OESA-2025-1819","RHLW-2026-44a75016eab78e73","RHLW-2026-8f37e023b4e3806b","RHSA-2025:11695","RHSA-2025:11741","RHSA-2025:14177","RHSA-2025:14178","RHSA-2025:14179","RHSA-2025:14180","RHSA-2025:14181","RHSA-2025:14182","RHSA-2025:14183","RLSA-2025:14177","RLSA-2025:14178","RLSA-2025:14179","RLSA-2025:14181","ROOT-APP-MAVEN-CVE-2025-48976","SUSE-SU-2025:02159-1","SUSE-SU-2025:02184-1","UBUNTU-CVE-2025-48976","openSUSE-SU-2025:15208-1"],"status":"published","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.32877,"percentile":0.98366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-770"],"published":"2025-06-16T15:00:48Z","modified":"2026-11-09T12:49:26Z","exploits":[{"source":"pocgithub","id":"nankuo/CVE-2025-48976_CVE-2025-48988","title":"nankuo/CVE-2025-48976_CVE-2025-48988","date":"2025-06-23","url":"https://github.com/nankuo/CVE-2025-48976_CVE-2025-48988"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-fileupload2-core","fixed_in":["2.0.0-M4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.5-tuxcare.2","1.2.2-tuxcare.2","1.2.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-fileupload-java","fixed_in":["1.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.52-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.52-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat11","fixed_in":["11.0.15-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat11","fixed_in":["11.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"apache-commons-fileupload","fixed_in":["1.4-5.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-fileupload","fixed_in":["1.4-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"tomcat","fixed_in":["9.0.100-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","fixed_in":["9.0.100-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","fixed_in":["9.0.100-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","fixed_in":["9.0.100-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","fixed_in":["9.0.100-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.5.0.rhlw-00002"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.commons-fileupload:commons-fileupload","fixed_in":["1.5-root.io.1","1.5-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.5-aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-fileupload","fixed_in":["1.6.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"jakarta-commons-fileupload","fixed_in":["1.6.0-126.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"jakarta-commons-fileupload","fixed_in":["1.6.0-126.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-fileupload","fixed_in":["1.6.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-fileupload2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-M1"},{"fixed":"2.0.0-M4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5-tuxcare.2"}]}],"versions":["1.5","1.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"1.2.2-tuxcare.2"}]}],"versions":["1.2.2","1.2.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.1"},{"fixed":"1.2.1-tuxcare.2"}]}],"versions":["1.2.1","1.2.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1"},{"fixed":"1.3.1-tuxcare.1"}]}],"versions":["1.3.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2","1.5-1","1.5-1.1","1.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1.1","1.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1"}]}],"versions":["1.5-1.1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.46-1"}]}],"versions":["10.1.40-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.11-1"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.107-0+deb11u1"}]}],"versions":["9.0.43-1","9.0.43-2","9.0.43-2~deb11u1","9.0.43-2~deb11u10","9.0.43-2~deb11u11","9.0.43-2~deb11u12","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9","9.0.43-3","9.0.53-1","9.0.54-1","9.0.55-1","9.0.58-1","9.0.62-1","9.0.63-1","9.0.64-1","9.0.64-2","9.0.65-1","9.0.67-1","9.0.68-1","9.0.68-1.1","9.0.70-1","9.0.70-2","9.0.95-1"],"bundled":11},{"source":"osv","ecosystem":"Debian:11","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1+deb11u1"}]}],"versions":["1.4-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"],"bundled":13},{"source":"osv","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.6.0"}]}],"versions":["1.0","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3","1.3.1","1.3.1-jenkins-1","1.3.1-jenkins-2","1.3.2","1.3.3","1.4","1.5"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-fileupload2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-M1"},{"fixed":"2.0.0-M4"}]}],"versions":["2.0.0-M1","2.0.0-M2","2.0.0-M3"]},{"source":"osv","ecosystem":"Mageia:9","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-5.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.rhlw-00001"}]}],"versions":["1.0","1.0-beta-1","1.0-rc1","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3","1.3.1","1.3.1-jenkins-1","1.3.1-jenkins-2","1.3.2","1.3.3","1.4","1.4.0"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.0.rhlw-00002"}]}],"versions":["1.5","1.5.0"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-root.io.1"},{"fixed":"1.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-126.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-126.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2","6.0.39-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-1","1.3.1-2","1.3.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7","9.0.16-3ubuntu0.18.04.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1","1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1","9.0.31-1ubuntu0.9+esm2","9.0.31-1ubuntu0.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3","9.0.58-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2","1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1","10.1.16-1ubuntu0.1~esm2","10.1.16-1ubuntu0.1~esm3","10.1.16-1ubuntu0.1~esm4","10.1.55-1ubuntu2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1","1.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.35-1","10.1.40-1","10.1.40-1ubuntu1","10.1.40-1ubuntu1.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.54-1","10.1.54-1ubuntu1","10.1.54-1ubuntu2","10.1.55-1ubuntu1","10.1.55-1ubuntu2","10.1.57~us1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.40-1ubuntu1.26.04.1","10.1.55-1ubuntu2~26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.1"}]}]}],"products":[{"vendor":"apache","product":"commons_fileupload"},{"vendor":"apache software foundation","product":"apache commons fileupload"}],"references":[{"url":"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/16/4","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","tags":["advisory"]},{"url":"https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","tags":["web","report"]},{"url":"https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14177","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48976","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48988","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49125","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52434","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52520","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-53506","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373309","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379386","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-14177.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14178","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-14178.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14181","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-14181.html","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48976.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48976","tags":["advisory"]},{"url":"https://github.com/apache/commons-fileupload","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0296.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34377","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/4","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/O4NTTRMGJEETFRWJKHNAERLI3E52LN2W/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1706","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1765","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1814","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1815","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49125","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1817","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1818","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1819","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24998.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hfrx-6qgj-fp6c","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11695","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11695.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48976","tags":["advisory","report"]},{"url":"https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","tags":["advisory"]},{"url":"https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49125","tags":["advisory"]},{"url":"https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52434","tags":["advisory"]},{"url":"https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52520","tags":["advisory"]},{"url":"https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","tags":["advisory"]},{"url":"https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11741","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373309","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14177.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","tags":["advisory"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14178.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14179","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14179.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14180","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14180.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14182","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14182.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14183","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14183.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14177","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14178","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14179","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502159-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244657","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48976","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502184-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48976","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/74f69ffaf61e54c727603e7e831fe20f0ac5d2a7","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/667ddd76e2a0e762f3a784d86f0d25e7fd7cdb86","tags":["report"]},{"url":"https://github.com/apache/commons-fileupload/commit/2108495a4775910b8559f18ed5a779d60542ee96","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48976","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:00:48.14Z","modified":"2025-11-03T20:05:02.486Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-18407","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:00:48Z","modified":"2025-11-03T20:05:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-vv7r-c36w-3prj","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2025-11-03T22:59:06Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.46Z","modified":"2026-06-17T09:30:35.803Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-48976","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:00:48.14Z","modified":"2026-10-28T02:31:08.051366957Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.  This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.  Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.46Z","modified":"2026-10-27T05:00:07.87303553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-vv7r-c36w-3prj","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2026-09-10T03:50:25.460226397Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"OESA-2025-1706","title":"apache-commons-fileupload security update","description":"The javax.servlet package lacks support for RFC-1867, HTML file upload.  This package provides a simple to use API for working with such data.  The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-04T11:08:47Z","modified":"2026-08-18T01:18:23.314283363Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1765","title":"apache-commons-fileupload security update","description":"The javax.servlet package lacks support for RFC-1867, HTML file upload.  This package provides a simple to use API for working with such data.  The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.638368437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1814","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.541867437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1815","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.620089719Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1816","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)\n\nAuthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.579362368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1817","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.617217212Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1818","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.528820016Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1819","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:53.397964512Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHLW-2026-44a75016eab78e73","title":"Lightwell Security Advisory: commons-fileupload 1.4.0.rhlw-00001","description":"Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976.\n\nCVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts\n\nCVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers\n\nThis patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.4.0 from Maven Central.","status":"published","published":"2026-10-12T16:54:17Z","modified":"2026-10-27T04:00:09.743298808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-8f37e023b4e3806b","title":"Lightwell Security Advisory: commons-fileupload 1.5.0.rhlw-00002","description":"Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.5.0.rhlw-00002 with a backported security fix.\n\nCVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers\n\nThis patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.5.0 from Maven Central.","status":"published","published":"2026-10-08T19:45:22Z","modified":"2026-10-29T14:30:05.390828373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2025:11695","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update","status":"published","published":"2025-07-29T10:07:17Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11741","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update","status":"published","published":"2025-07-31T10:08:51Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14177","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14178","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14179","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14180","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14181","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14182","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14183","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-09-08T14:19:16.612452Z","modified":"2025-09-08T15:03:16.580879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:48.482776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14179","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:19:16.34748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-04T00:50:08.535095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.","status":"published","published":"2025-06-16T15:15:00Z","modified":"2026-11-09T12:49:26.527076937Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"ALSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:02:22.332186276Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:30:04.065723321Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:32:27.691470691Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2026-1777509601","title":"TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:47:16.857301676Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509603","title":"TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:47:18.75873859Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777941823","title":"TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:46:28.825754681Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1785906695","title":"TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.1.","status":"published","published":"2026-08-05T05:11:35Z","modified":"2026-10-15T09:46:44.403748866Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"DLA-4244-1","title":"tomcat9 - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:09:38.37694Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DLA-4245-1","title":"libcommons-fileupload-java - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:10:08.822332Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6120-1","title":"tomcat10 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:11:28.926265Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6121-1","title":"tomcat11 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:08:55.570487Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0296","title":"Updated apache-commons-fileupload packages fix security vulnerability","description":"Apache Commons FileUpload: FileUpload DoS via part headers. (CVE-2025-48976)\n","status":"published","published":"2025-11-15T07:11:33Z","modified":"2026-04-16T04:41:08.519816261Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15208-1","title":"apache-commons-fileupload-1.6.0-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-fileupload-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:29.917517Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-48976","title":"CVE-2025-48976 in io.root.commons-fileupload:commons-fileupload - Patched by Root","description":"Root has patched CVE-2025-48976 in the io.root.commons-fileupload:commons-fileupload package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-17T12:31:41Z","modified":"2026-06-17T18:15:29.4496097Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2025:02159-1","title":"Security update for apache-commons-fileupload","description":"This update for apache-commons-fileupload fixes the following issues:\nUpgrade to upstream version 1.6.0\n\n- CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient limits can lead to a DoS (bsc#1244657).\n\nFull changelog:\n\nhttps://commons.apache.org/proper/commons-fileupload/changes.html#a1.6.0\n","status":"published","published":"2025-06-27T14:56:05Z","modified":"2026-02-04T03:48:13.737077Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02184-1","title":"Security update for jakarta-commons-fileupload","description":"This update for jakarta-commons-fileupload fixes the following issues:\n\nUpgrade to upstream version 1.6.0\n\n- CVE-2025-48976: Fixed allocation of resources for multipart headers with insufficient limits can lead to a DoS (bsc#1244657).\n\nFull changelog:\n\nhttps://commons.apache.org/proper/commons-fileupload/changes.html#a1.6.0\n","status":"published","published":"2025-07-01T08:14:12Z","modified":"2026-03-23T04:49:34.959332Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}