The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Aug 22, 2016 | Jul 4, 2016 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.70Upgrade Apache Tomcat to 8.0.36Upgrade Apache Tomcat to 8.5.3Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.0 | Jul 4, 2016 | Jul 4, 2016 |
| Debian | — | Upgrade tomcat7Upgrade libcommons-fileupload-java | Jul 2, 2016 | Jul 2, 2016 |
| Freebsd | — | Upgrade tomcat7Upgrade tomcat8Upgrade apache-struts | Dec 10, 2025 | Jun 26, 2016 |
| Gentoo Linux | — | Upgrade dev-java/commons-fileupload.Upgrade www-servers/tomcat. | Oct 30, 2017 | Jul 4, 2016 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT2 to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest version | Aug 11, 2017 | Jul 4, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webapps | Nov 30, 2017 | Jul 4, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jul 4, 2016 |
| Jenkins 2017 10 11 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.73.2Upgrade Jenkins to version 2.84 | Nov 13, 2017 | Jul 4, 2016 |
| Jenkins 2017 10 11_cve 2017 1000394 | — | — | Nov 20, 2017 | Jul 4, 2016 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3 | May 29, 2017 | Jul 4, 2016 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat | Nov 9, 2016 | Jun 21, 2016 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2016 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-api | Nov 4, 2016 | Jul 4, 2016 |
| Suse | — | Upgrade tomcat-el-2_2-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2_3-apiUpgrade tomcat | Aug 30, 2016 | Jul 4, 2016 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat6-javaUpgrade libtomcat7-java | Jul 5, 2016 | Jul 4, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub