CVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/commons-fileupload:commons-fileuploadto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
maven/org.apache.commons:commons-fileupload2-coreto a version that resolves this vulnerability.Fixed in 2.0.0-M4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.117.1.3.1 - Upgrade
Upgrade
Apache Commons FileUploadto a version that resolves this vulnerability.Fixed in 1.6 - Upgrade
Upgrade
Apache Commons FileUploadto a version that resolves this vulnerability.Fixed in 2.0.0-M4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48976?
CVE-2025-48976 has a severity rating that indicates a denial of service vulnerability due to improper handling of multipart headers.
How do I fix CVE-2025-48976?
To fix CVE-2025-48976, upgrade Apache Commons FileUpload to version 1.6.0 or 2.0.0-M4.
Which versions are affected by CVE-2025-48976?
CVE-2025-48976 affects Apache Commons FileUpload versions prior to 1.6.0 and versions from 2.0.0-M1 before 2.0.0-M4.
What type of vulnerability is CVE-2025-48976?
CVE-2025-48976 is classified as a denial of service (DoS) vulnerability.
Is there a workaround for CVE-2025-48976?
There is no documented workaround for CVE-2025-48976; upgrading to a fixed version is recommended.