CVE-2016-3092: Input Validation
Apache Tomcat uses a package renamed copy of Apache Commons FileUpload to implement the file upload requirements of the Servlet specification. A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if the boundary was the typical tens of bytes long.
External references:
http://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-7.html
Upstream fixes:
Tomcat 8.5.x:
http://svn.apache.org/viewvc?view=revision&revision=1743722
Tomcat 8.0.x:
http://svn.apache.org/viewvc?view=revision&revision=1743738
Other sources
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3092?
CVE-2016-3092 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2016-3092?
To remediate CVE-2016-3092, upgrade Apache Commons Fileupload to version 1.3.2 or later, and ensure Apache Tomcat is updated to at least version 7.0.70, 8.0.36, 8.5.3, or 9.0.0-M7.
What type of attack is possible with CVE-2016-3092?
CVE-2016-3092 allows remote attackers to perform denial of service attacks by sending long boundary strings that consume excessive CPU resources.
Which software versions are affected by CVE-2016-3092?
Affected versions include Apache Commons Fileupload prior to 1.3.2 and various Apache Tomcat versions below specified thresholds.
Is CVE-2016-3092 still a risk if updated software is running?
No, if the software has been updated to the fixed versions, the risk associated with CVE-2016-3092 is mitigated.