The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Aug 22, 2016 | Jul 4, 2016 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.36Upgrade Apache Tomcat to 7.0.70Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to 8.5.3Upgrade Apache Tomcat to the latest available version | Jul 4, 2016 | Jul 4, 2016 |
| Debian | — | Upgrade tomcat7Upgrade libcommons-fileupload-java | Jul 2, 2016 | Jul 2, 2016 |
| Freebsd | — | Upgrade apache-strutsUpgrade tomcat8Upgrade tomcat7 | Dec 10, 2025 | Jun 26, 2016 |
| Gentoo Linux | — | Upgrade www-servers/tomcat.Upgrade dev-java/commons-fileupload. | Oct 30, 2017 | Jul 4, 2016 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22TOMCAT.TOMCAT2 to the latest version | Aug 11, 2017 | Jul 4, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-lib | Nov 30, 2017 | Jul 4, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jul 4, 2016 |
| Jenkins 2017 10 11 | — | Upgrade Jenkins to version 2.84Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.73.2 | Nov 13, 2017 | Jul 4, 2016 |
| Jenkins 2017 10 11_cve 2017 1000394 | — | — | Nov 20, 2017 | Jul 4, 2016 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3 | May 29, 2017 | Jul 4, 2016 |
| Oracle_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-el-2.2-api | Nov 9, 2016 | Jun 21, 2016 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2016 |
| Redhat_linux | — | Upgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-lib | Nov 4, 2016 | Jul 4, 2016 |
| Suse | — | Upgrade tomcatUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-lib | Aug 30, 2016 | Jul 4, 2016 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat6-javaUpgrade tomcat8 | Jul 5, 2016 | Jul 4, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub