DoS Vulnerability in Apache Commons FileUpload and Tomcat9 Packages
Summary
DEBIAN-CVE-2025-48976: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. Affects libcommons-fileupload-java versions < 1.4-1+deb11u1. Fixed in 1.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a library that provides support for file uploads in Java applications. It is widely used in conjunction with web servers and applications to handle multipart file uploads. The affected versions of this library, prior to 1.6, have a vulnerability that allows for Denial of Service (DoS) attacks due to insufficient limits on multipart headers. Tomcat9, a popular Java Servlet container, also utilizes this library, making it susceptible to the same vulnerability.
Vulnerability Detail
The vulnerability arises from the allocation of resources for multipart headers without adequate limits, which can lead to a Denial of Service (DoS) condition. Attackers can exploit this flaw by sending specially crafted multipart requests that overwhelm the server, causing it to become unresponsive. This issue affects Apache Commons FileUpload versions from 1.0 before 1.6 and from 2.0.0-M1 before 2.0.0-M4. The ramifications include potential downtime and service disruption for applications relying on these libraries.
How To Fix
Minimum fixed version
1.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement request size limits in their application configurations to mitigate the risk of DoS attacks until the packages are updated. This can be done by setting appropriate limits on the size of multipart requests in the server configuration.
Conclusion
In summary, the vulnerability in Apache Commons FileUpload and Tomcat9 poses a significant risk of Denial of Service attacks due to insufficient limits on multipart headers. Users are strongly advised to upgrade to the patched versions of the affected packages to ensure the security and stability of their applications.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by insufficient limits on multipart headers in Apache Commons FileUpload.
Apache Commons FileUpload versions prior to 1.6 and Tomcat9 versions prior to 9.0.107-0+deb11u1 for Debian 11 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to service disruption and downtime for applications that rely on the affected libraries, as attackers can exploit it to make the server unresponsive.
Yes, implementing request size limits in your application configurations can help mitigate the risk of DoS attacks until the packages are updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
