CVE-2025-48976 Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

🗓️ 16 Jun 2025 15:00:48Reported by apacheType

DoS vulnerability in Apache Commons FileUpload due to multipart headers resource limits. Upgrade recommended.

Reporter	Title	Published	Views	Family All 335
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses uthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.	9 Jul 202507:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)	3 Sep 202518:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2025-48976)	15 Aug 202509:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Apache Tomcat vulnerabilities (CVE-2025-48976, CVE-2025-48988)	17 Jul 202518:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by a Denial of Service (DoS) vulnerability in Apache Commons FileUpload.	20 Sep 202500:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	30 Oct 202520:15	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	9 Mar 202610:35	–	ibm
IBM Security Bulletins	Security Bulletin:IBM WebSphere Application Server Liberty shipped with IBM OpenPages is vulnerable to multiple vulnerabilities	7 Oct 202519:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	14 Nov 202514:06	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service due to Apache Commons FileUpload (CVE-2025-48976)	4 Sep 202509:02	–	ibm

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "commons-fileupload:commons-fileupload",
    "product": "Apache Commons FileUpload",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.6",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.commons:commons-fileupload2",
    "product": "Apache Commons FileUpload",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.0.0-M4",
        "status": "affected",
        "version": "2.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12

16 Jun 2025 15:00Current

EPSS0.67267