Denial of Service Vulnerability in Apache Commons Fileupload (CVE-2016-3092)
Summary
CVE-2016-3092: The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers... Affects libcommons-fileupload-java across 58 version ranges.
< 0b2140180148548e012498e2d7c074fb9d208beb
< 1.3.2-1
< 1b734919fd5ee83a2905070dcbd6ffffff1beb63
< 2b858c0fce0db18ca733b161d7428f2cca214841
< 4a39288c6eab999452c72af9fd1a0c12b054ca9f
< 4c8b650437e2464c1c31c6598a263b3805b7a81f
< 04d13f45b4268945a0bee7a56fc4cf3782db0c71
< 5e096bfd5a387f057766dc6b5217feae75b08331
< 05e76dc1b6edcc2fa87d95de72a8a714267e462d
< 5f6f258107e7e463cce41187e13474f3c894693e
< 6b77b128188a5ed033da2998ff2f47f65aa4f7f8
< 6e2c7f6227de95874c79f77bafe5ed26dfeb4021
< 7cfeba335a41dd3b0e423f12534e5936c461711c
< 7e8629b4ff4152ae6285fa184745e9a1382ca440
< 8b83cefaf2a454706f03f509944ca46103db4d13
< 8d84136656655a20287cf2dac6ec7fd047979de5
< 009cf0448025b6227b026e66f5351f0dcb3dd733
< 9e0d31f12dbd5441097dbec493895ad4e07a6832
< 9f62bc56a0887353e58579153a30c64c5369efdb
< 20bd21830dfe7864cac78acb1b7c825baa11bd85
< 29b07def810d335012e738b22ab44d4e232b50d1
< 30a7e7f7b48aa5f9f4a559635966d70901b5f51d
< 47af1012111595546f31d9096a37a839f93caa62
< 68e114cf9fe0a83a888099c084b3036040afa518
< 72a8a7c601a7bff56723650d5bb1e353d095af3d
< 81d3e54a46de226a5a8f11bcc65195cddcc24f96
< 85cfeb746b8ea0d0e51cc4ced6053075f5460a36
< 86ecd2ad87b805992b9e4c2f2317feaab7a1e3fb
< 511d6f15e4254f3af12c75e5199b66448342eabf
< 892c777b9d5c051dc20aacfefc280ab02dbe2143
< 32583ea28061391c314a09a43fbee48c072940a9
< 53728ececd4dc0134c2e17de849db53ce08219c9
< 3477614af783b612341fa6bc00c16b32d1791de8
< 1958059057715d26415839cabad78e685d4d02f1
< a6d2ed3eef40903b661d138ae7c8fbd9790d1928
< ad3da1182b0ed370ec233b925c69dcee826a9efe
< b7b373b84f1b80602ed62fb056be7c7ce429a15c
< b7d6e626d03f61ccd6c92e8ea28df12e67d256e6
< ba53773f48f31de787edb559db38e3e02d7efffd
< bc8b8705a9713cbd0232ab2d326d96ceb4aef1ad
< be7e6137267298d6a7b1b3cd2cb1f3f605f9162b
< c845090723d1118dbce1928f9468e1726b79c3b1
< d1dc05e934e089ea8907998cf850760017a0ed82
< d8ebf61e51b4455e3c226751e492a533f9002d48
< d70fcee0390d1a82b108979d26a7a397a7418bc7
< ddd8de1c64ef852caca10ab876fed02cfe827ef1
< de47b464201769870a06764cdd5143a59cd95302
< e0ffdd2535a8cb102c62b5db41170625e9d1bf46
< e19f0d04ff9d28e5e0d7bc6a4e98b6f04cec6bf8
< e37b977db6f47e4380ad67114a49e8568951c953
< e498667bd7811e846771a852b16ce9f1e524b81b
< eae5ead3864c4e2d528a874069828c6c12dee8a5
< efa0e79f82f17880c0d7427918bc34a83243dfa6
< f5dffa6e1148080fe5dc3690df917e805c72a714
< f6de6eb5445d266506fcf89d3962a622478c2c6c
< fd7f13635e6855f6ba3fead0bf37ba2fbf8b68cf
< feaf3763fb37e4a9176ef46a2c80e34821077884
< fec4a6d1d1f050401aec5c6a3bd0431850472d92
Fixed in 1.3.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Fileupload is a popular library used for handling file uploads in Java applications. It provides a simple API for processing multipart/form-data requests, which are commonly used in web applications for file uploads. The library is widely utilized in various frameworks, including Apache Tomcat. However, prior to version 1.3.2, it contained a vulnerability that could be exploited by attackers to cause excessive CPU consumption, leading to denial of service.
Vulnerability Detail
The vulnerability arises from the MultipartStream class in Apache Commons Fileupload, which fails to properly handle long boundary strings in multipart requests. This flaw allows remote attackers to send specially crafted requests that consume significant CPU resources, potentially leading to service degradation or complete unavailability. The vulnerability affects multiple versions of Apache Tomcat and other products that rely on this library, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
1.3.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting on file upload requests to mitigate the impact of this vulnerability. Additionally, you can validate the length of boundary strings before processing requests to prevent excessively long inputs from being processed.
Conclusion
CVE-2016-3092 is a significant vulnerability in the Apache Commons Fileupload library that can lead to denial of service through CPU exhaustion. It is crucial for users to upgrade to version 1.3.2 or later to mitigate this risk. Implementing workarounds can provide temporary relief, but upgrading is the most effective solution.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
CVE-2016-3092 is a vulnerability in the Apache Commons Fileupload library that allows remote attackers to cause denial of service through excessive CPU consumption.
Versions of Apache Commons Fileupload prior to 1.3.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2016-3092 is 7.5, indicating a high severity level.
Yes, you can implement rate limiting on file uploads and validate boundary string lengths to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
