The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Aug 22, 2016 | Jul 4, 2016 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.3Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.70Upgrade Apache Tomcat to 8.0.36 | Jul 4, 2016 | Jul 4, 2016 |
| Debian | — | Upgrade libcommons-fileupload-javaUpgrade tomcat7 | Jul 2, 2016 | Jul 2, 2016 |
| Freebsd | — | Upgrade tomcat7Upgrade apache-strutsUpgrade tomcat8 | Dec 10, 2025 | Jun 26, 2016 |
| Gentoo Linux | — | Upgrade dev-java/commons-fileupload.Upgrade www-servers/tomcat. | Oct 30, 2017 | Jul 4, 2016 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22TOMCAT.TOMCAT2 to the latest version | Aug 11, 2017 | Jul 4, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-api | Nov 30, 2017 | Jul 4, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jul 4, 2016 |
| Jenkins 2017 10 11 | — | Upgrade Jenkins to version 2.84Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.73.2 | Nov 13, 2017 | Jul 4, 2016 |
| Jenkins 2017 10 11_cve 2017 1000394 | — | — | Nov 20, 2017 | Jul 4, 2016 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3 | May 29, 2017 | Jul 4, 2016 |
| Oracle_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-api | Nov 9, 2016 | Jun 21, 2016 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2016 |
| Redhat_linux | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat | Nov 4, 2016 | Jul 4, 2016 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-servlet-4_0-api | Aug 30, 2016 | Jul 4, 2016 |
| Ubuntu | — | Upgrade libtomcat6-javaUpgrade libtomcat7-javaUpgrade tomcat8 | Jul 5, 2016 | Jul 4, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub