The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Aug 22, 2016 | Jul 4, 2016 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.70Upgrade Apache Tomcat to 8.0.36Upgrade Apache Tomcat to 8.5.3Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to the latest available version | Jul 4, 2016 | Jul 4, 2016 |
| Debian | — | Upgrade tomcat7Upgrade libcommons-fileupload-java | Jul 2, 2016 | Jul 2, 2016 |
| Freebsd | — | Upgrade tomcat8Upgrade apache-strutsUpgrade tomcat7 | Dec 10, 2025 | Jun 26, 2016 |
| Gentoo Linux | — | Upgrade dev-java/commons-fileupload.Upgrade www-servers/tomcat. | Oct 30, 2017 | Jul 4, 2016 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22TOMCAT.TOMCAT2 to the latest version | Aug 11, 2017 | Jul 4, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-api | Nov 30, 2017 | Jul 4, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jul 4, 2016 |
| Jenkins 2017 10 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.73.2Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.84 | Nov 13, 2017 | Jul 4, 2016 |
| Jenkins 2017 10 11_cve 2017 1000394 | — | — | Nov 20, 2017 | Jul 4, 2016 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3 | May 29, 2017 | Jul 4, 2016 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat | Nov 9, 2016 | Jun 21, 2016 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2016 |
| Redhat_linux | — | Upgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-lib | Nov 4, 2016 | Jul 4, 2016 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-libUpgrade tomcat-webapps | Aug 30, 2016 | Jul 4, 2016 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat6-javaUpgrade tomcat8 | Jul 5, 2016 | Jul 4, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub