GitHub Advisoryadvisory · Maven

GHSA-xx68-jfcg-xmmf Commons FileUpload Denial of service vulnerability

HIGH Published 2018-12-21 Modified 2024-03-05 Official page ↗
Aliases
CVE-2014-0050
Ecosystem
Maven
Packages
commons-fileupload:commons-fileupload, org.apache.tomcat:tomcat
Severity
High
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• Maven commons-fileupload:commons-fileupload: < 1.3.1 → fixed in 1.3.1 • Maven org.apache.tomcat:tomcat: >= 8.0.0-RC1, < 8.0.3 → fixed in 8.0.3 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.52 → fixed in 7.0.52

Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Related

Alias · CVE (1)

  • CVE-2014-0050 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References