Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-48976

Fixed in a distro release EPSS 33%CVSS 7.5

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

Published 2025-06-16 · CVE record · OSV

Products: Apache Software Foundation Apache Commons FileUpload

Fixed upstream

EcosystemPackageFixed in
Mavencommons-fileupload:commons-fileupload1.6.0
Mavenorg.apache.commons:commons-fileupload2-core2.0.0-M4

Distro releases

ReleasePackageFixed in
AlmaLinux 10tomcat91:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-admin-webapps1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-docs-webapp1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-el-3.0-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-lib1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.3
AlmaLinux 10tomcat9-webapps1:9.0.87-5.el10_0.3
AlmaLinux 8tomcat1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-admin-webapps1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-docs-webapp1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-lib1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.6
AlmaLinux 8tomcat-webapps1:9.0.87-1.el8_10.6
AlmaLinux 9tomcat1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-admin-webapps1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-docs-webapp1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-lib1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.3
AlmaLinux 9tomcat-webapps1:9.0.87-3.el9_6.3
Arch Linuxtomcat10no fix
Arch Linuxtomcat9no fix
Chainguardgeoserver-2.262.26.3-r1
Chainguardgeoserver-2.26-community2.26.3-r1
Chainguardgeoserver-2.26-docker2.26.3-r1
Chainguardgeoserver-2.272.27.1-r1
Chainguardgeoserver-2.27-community2.27.1-r1
Chainguardgeoserver-2.27-docker2.27.1-r1
Chainguardjenkins-22.515-r0
Chainguardjenkins-2-openjdk-172.515-r0
Chainguardjenkins-2-openjdk-212.515-r0
Chainguardjenkins-2.504-openjdk-17no fix
Chainguardjenkins-2.504-openjdk-21no fix
Chainguardjenkins-compat2.515-r0
Chainguardjenkins-docker-agent2.515-r0
Chainguardjenkins-docker-agent-openjdk-172.515-r0
Chainguardjenkins-docker-agent-openjdk-212.515-r0
Chainguardjenkins-remoting2.515-r0
Chainguardjenkins-utils2.515-r0
Debian 11libcommons-fileupload-java1.4-1+deb11u1
Debian 11tomcat99.0.107-0+deb11u1
Debian 12libcommons-fileupload-javano fix
Debian 12tomcat1010.1.52-1~deb12u1
Debian 12tomcat99.0.70-2
Debian 13libcommons-fileupload-javano fix
Debian 13tomcat1010.1.52-1~deb13u1
Debian 13tomcat1111.0.15-1~deb13u1
Debian 13tomcat99.0.70-2
Debian 14libcommons-fileupload-javano fix
Debian 14tomcat1010.1.46-1
Debian 14tomcat1111.0.11-1
Debian 14tomcat99.0.70-2
Red Hat Enterprise Linux 10.0tomcat1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-admin-webapps1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-docs-webapp1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-el-5.0-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-jsp-3.1-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-lib1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-servlet-6.0-api1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat-webapps1:10.1.36-1.el10_0.2
Red Hat Enterprise Linux 10.0tomcat91:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-admin-webapps1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-docs-webapp1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-el-3.0-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-jsp-2.3-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-lib1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-servlet-4.0-api1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 10.0tomcat9-webapps1:9.0.87-5.el10_0.3
Red Hat Enterprise Linux 8tomcat1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-admin-webapps1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-docs-webapp1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-lib1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 8tomcat-webapps1:9.0.87-1.el8_10.6
Red Hat Enterprise Linux 9tomcat1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-admin-webapps1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-docs-webapp1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-el-3.0-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-jsp-2.3-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-lib1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-servlet-4.0-api1:9.0.87-3.el9_6.3
Red Hat Enterprise Linux 9tomcat-webapps1:9.0.87-3.el9_6.3
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-admin-webapps0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-docs-webapp0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-el-3.0-api0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk110:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-java-jdk80:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-javadoc0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-jsp-2.3-api0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-lib0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-selinux0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-servlet-4.0-api0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-12.redhat_00011.1.el8jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-12.redhat_00011.1.el7jws
Red Hat jboss enterprise web server 5.8jws5-tomcat-webapps0:9.0.87-12.redhat_00011.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-admin-webapps0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-docs-webapp0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-el-5.0-api0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-javadoc0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-jsp-3.1-api0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-lib0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-selinux0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-7.redhat_00008.1.el10jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-servlet-6.0-api0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-7.redhat_00008.1.el9jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-7.redhat_00008.1.el8jws
Red Hat jboss enterprise web server 6.1jws6-tomcat-webapps0:10.1.36-7.redhat_00008.1.el10jws
Red Hat rhel e4s 8.8tomcat1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-lib1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.7
Red Hat rhel e4s 8.8tomcat-webapps1:9.0.87-1.el8_8.7
Red Hat rhel e4s 9.2tomcat1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-admin-webapps1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-docs-webapp1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-el-3.0-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-jsp-2.3-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-lib1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-servlet-4.0-api1:9.0.87-1.el9_2.6
Red Hat rhel e4s 9.2tomcat-webapps1:9.0.87-1.el9_2.6
Red Hat rhel eus 9.4tomcat1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-admin-webapps1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-docs-webapp1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-el-3.0-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-jsp-2.3-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-lib1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-servlet-4.0-api1:9.0.87-1.el9_4.6
Red Hat rhel eus 9.4tomcat-webapps1:9.0.87-1.el9_4.6
Red Hat rhel tus 8.8tomcat1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-admin-webapps1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-docs-webapp1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-el-3.0-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-jsp-2.3-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-lib1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-servlet-4.0-api1:9.0.87-1.el8_8.7
Red Hat rhel tus 8.8tomcat-webapps1:9.0.87-1.el8_8.7
Rocky Linux 10tomcat1:10.1.36-1.el10_0.2
Rocky Linux 10tomcat91:9.0.87-5.el10_0.3
Rocky Linux 8tomcat1:9.0.87-1.el8_10.6
Rocky Linux 9tomcat1:9.0.87-3.el9_6.3
SUSE Enterprise Storage 7.1apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP6apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server 12 SP5-LTSSjakarta-commons-fileupload1.6.0-126.3.1
SUSE Linux Enterprise Server 15 SP3-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server 15 SP4-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server 15 SP5-LTSSapache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5jakarta-commons-fileupload1.6.0-126.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5apache-commons-fileupload1.6.0-150200.3.12.1
SUSE Manager Server 4.3apache-commons-fileupload1.6.0-150200.3.12.1
Ubuntu 16.04 LTSlibcommons-fileupload-javano fix
Ubuntu 18.04 LTSlibcommons-fileupload-javano fix
Ubuntu 20.04 LTSlibcommons-fileupload-javano fix
Ubuntu 22.04 LTSlibcommons-fileupload-javano fix
Ubuntu 24.04 LTSlibcommons-fileupload-javano fix
Ubuntu 24.04 LTStomcat10no fix
Ubuntu 25.10libcommons-fileupload-javano fix
Ubuntu 25.10tomcat10no fix
Ubuntu 25.10tomcat11no fix
Ubuntu 26.04 LTSlibcommons-fileupload-javano fix
Ubuntu 26.04 LTStomcat10no fix
Ubuntu 26.04 LTStomcat11no fix
Ubuntu 26.10libcommons-fileupload-javano fix
Ubuntu 26.10tomcat10no fix
Ubuntu Pro 14.04 LTStomcat6no fix
Ubuntu Pro 18.04 LTStomcat9no fix
Ubuntu Pro 20.04 LTStomcat9no fix
Ubuntu Pro 22.04 LTStomcat9no fix
Wolfijenkins-22.515-r0
Wolfijenkins-2-openjdk-172.515-r0
Wolfijenkins-2-openjdk-212.515-r0
Wolfijenkins-compat2.515-r0
Wolfijenkins-docker-agent2.515-r0
Wolfijenkins-docker-agent-openjdk-172.515-r0
Wolfijenkins-docker-agent-openjdk-212.515-r0
Wolfijenkins-remoting2.515-r0
Wolfijenkins-utils2.515-r0
openSUSE Leap 15.6apache-commons-fileupload1.6.0-150200.3.12.1
openSUSE Tumbleweedapache-commons-fileupload1.6.0-1.1