CVE-2016-3092: commons-fileupload:commons-fileupload - Denial of Service Vulnerability
Summary
CVE-2016-3092: High severity vulnerability that affects commons-fileupload:commons-fileupload. Affects commons-fileupload:commons-fileupload versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- libcommons-fileupload-java · Debian:11
The same CVE-2016-3092 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
commons-fileupload:commons-fileupload is a popular Java library used for handling file uploads in web applications. It provides functionality to parse and process multipart/form-data requests. This vulnerability affects versions prior to 1.3.2 and is also present in Apache Tomcat versions 7.x, 8.x, 8.5.x, and 9.x. The MultipartStream class in Apache Commons Fileupload allows remote attackers to cause a denial of service (CPU consumption) by sending a request with a long boundary string.
Vulnerability Detail
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat and other products, is vulnerable to a denial of service attack. By sending a request with a long boundary string, an attacker can cause excessive CPU consumption, leading to a denial of service condition. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading the affected packages.
Conclusion
The CVE-2016-3092 vulnerability in commons-fileupload:commons-fileupload can lead to a denial of service attack by consuming excessive CPU resources. It is crucial to upgrade to the patched versions mentioned above to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commons-fileupload:commons-fileupload →
FAQ
This vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU resources, potentially leading to service unavailability.
Versions prior to 1.3.2 of commons-fileupload are affected by this vulnerability.
There are no known public exploits available for this vulnerability at the moment.
Yes, this vulnerability has a CVSS score of 7.5, indicating a high severity level.
Yes, upgrading to Apache Commons Fileupload version 1.3.2 or later, and Apache Tomcat versions 7.0.70, 8.0.36, 8.5.3, or 9.0.0.M7 will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for commons-fileupload:commons-fileupload.
