The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Aug 22, 2016 | Jul 4, 2016 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.3Upgrade Apache Tomcat to 7.0.70Upgrade Apache Tomcat to 8.0.36 | Jul 4, 2016 | Jul 4, 2016 |
| Debian | — | Upgrade libcommons-fileupload-javaUpgrade tomcat7 | Jul 2, 2016 | Jul 2, 2016 |
| Freebsd | — | Upgrade tomcat7Upgrade apache-strutsUpgrade tomcat8 | Dec 10, 2025 | Jun 26, 2016 |
| Gentoo Linux | — | Upgrade www-servers/tomcat.Upgrade dev-java/commons-fileupload. | Oct 30, 2017 | Jul 4, 2016 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22TOMCAT.TOMCAT2 to the latest version | Aug 11, 2017 | Jul 4, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-lib | Nov 30, 2017 | Jul 4, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jul 4, 2016 |
| Jenkins 2017 10 11 | — | Upgrade Jenkins LTS to version 2.73.2Upgrade Jenkins to version 2.84Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Nov 13, 2017 | Jul 4, 2016 |
| Jenkins 2017 10 11_cve 2017 1000394 | — | — | Nov 20, 2017 | Jul 4, 2016 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.3-0.175.3.11.0.4.0 on Solaris 11.3 | May 29, 2017 | Jul 4, 2016 |
| Oracle_linux | — | Upgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Nov 9, 2016 | Jun 21, 2016 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2016 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsvc | Nov 4, 2016 | Jul 4, 2016 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3_0-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-admin-webapps | Aug 30, 2016 | Jul 4, 2016 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat7-javaUpgrade libtomcat6-java | Jul 5, 2016 | Jul 4, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub