DoS Vulnerability in Apache Commons FileUpload and Tomcat Packages
Summary
CVE-2025-48976: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. Affects libcommons-fileupload-java across 2 version ranges.
< 1.4-1+deb11u1
>= cdfbeaa120cba6a8f1527b91600317ee374450c2, < f3e030f09ac8b01b684466c793dec86eafe1e4c9
Fixed in 1.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a library that provides support for file uploads in Java web applications. It is widely used in conjunction with servlet containers like Apache Tomcat. The library allows developers to handle multipart/form-data requests, which are essential for file uploads. However, certain versions of this library and associated packages are vulnerable to a denial-of-service (DoS) attack due to insufficient limits on resource allocation for multipart headers.
Vulnerability Detail
The vulnerability, identified as CVE-2025-48976, arises from the allocation of resources for multipart headers without adequate limits. This can lead to a denial-of-service condition, where an attacker can exploit the weakness to overwhelm the server, causing it to become unresponsive. The affected versions include Apache Commons FileUpload from 1.0 before 1.6 and from 2.0.0-M1 before 2.0.0-M4, as well as various versions of Tomcat that utilize this library.
How To Fix
Minimum fixed version
1.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on file uploads to mitigate the impact of the DoS attack. This can be done by configuring your web server to limit the size of incoming requests and the number of concurrent uploads.
Conclusion
The CVE-2025-48976 vulnerability poses a significant risk to applications using Apache Commons FileUpload and Tomcat. It is crucial to upgrade to the latest patched versions to ensure the security and stability of your applications. Additionally, implementing rate limiting can help mitigate potential attacks until the upgrade is completed.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
CVE-2025-48976 is a vulnerability in Apache Commons FileUpload and Tomcat packages that allows for denial-of-service attacks due to insufficient limits on multipart header resource allocation.
The affected versions include Apache Commons FileUpload from 1.0 before 1.6 and from 2.0.0-M1 before 2.0.0-M4, as well as various versions of Tomcat that utilize this library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Upgrade to the patched versions of the affected packages: Apache Commons FileUpload to version 1.6 or 2.0.0-M4, and Tomcat to version 9.0.70-2 or later.
Yes, you can implement rate limiting on file uploads to mitigate the impact of the DoS attack as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
