Bug 2373020 (CVE-2025-48976)

Summary: CVE-2025-48976 apache-commons-fileupload: Apache Commons FileUpload DoS via part headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, asoldano, ataylor, bbaranow, bmaxwell, brian.stansberry, ccranfor, cdewolf, chfoley, cmiranda, csutherl, darran.lofthouse, dhanak, dkreling, dosoudil, drosa, ehelms, eric.wittmann, fjuma, fmariani, ggainey, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jclere, jpechane, jpoth, jrokos, jscholz, juwatts, kverlaen, lgao, mhulan, mnovotny, mosmerov, msochure, msvehla, nipatil, nmoumoul, nwallace, osousa, pantinor, pcongius, pcreech, pdelbell, pesilva, pjindal, plodge, pmackay, rchan, rkubis, rstancel, rstepani, sausingh, sdawley, smaestri, smallamp, swoodman, szappis, tcunning, tom.jenkinson, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2373069, 2373070    
Bug Blocks:    

Description OSIDB Bzimport 2025-06-16 16:01:10 UTC 
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.