Denial of Service Vulnerability in libcommons-fileupload-java: Apache Commons Fileupload MultipartStream Class
Summary
DEBIAN-CVE-2016-3092: The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers... Affects libcommons-fileupload-java versions < 1.3.2-1. Fixed in 1.3.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-fileupload-java is a Java library that provides support for file uploads in web applications. It is widely used in conjunction with Java-based web servers like Apache Tomcat. The library facilitates the handling of multipart/form-data requests, which are essential for file uploads. However, prior to version 1.3.2, the MultipartStream class contained a vulnerability that could be exploited by attackers to cause excessive CPU consumption, leading to denial of service.
Vulnerability Detail
The vulnerability arises from the MultipartStream class in Apache Commons Fileupload versions before 1.3.2. It allows remote attackers to send a long boundary string, which can lead to high CPU usage and potentially crash the server. This issue affects various versions of Apache Tomcat and other products that utilize this library, making it a significant concern for web applications relying on file uploads.
How To Fix
Minimum fixed version
1.3.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the length of boundary strings in multipart requests. This can help mitigate the risk of denial of service until the package is updated.
Conclusion
The vulnerability in the libcommons-fileupload-java package poses a significant risk of denial of service due to excessive CPU consumption from long boundary strings. It is crucial to update to the patched version to mitigate this risk and ensure the stability of web applications that rely on file uploads.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
The vulnerability can lead to denial of service by consuming excessive CPU resources, potentially crashing the server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the patch is available in version 1.3.2-1 of the libcommons-fileupload-java package.
Implement input validation to restrict the length of boundary strings in multipart requests as a temporary workaround.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2016-3092.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
