Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2014-0050

85
FAUCET Score

CVE-2014-0050 describes a denial-of-service vulnerability in Apache Commons FileUpload before version 1.3.1, impacting products like Apache Tomcat and JBoss Web. Remote attackers can exploit this by sending a specially crafted Content-Type header, leading to an infinite loop and high CPU consumption. With a CVSS score of 7.5 and an EPSS score indicating high exploitability, this flaw allows unauthenticated attackers to easily disrupt affected systems. While not on the CISA KEV catalog, exploit modules exist in Metasploit and ExploitDB, and it has garnered significant community discussion and media coverage, suggesting a high likelihood of exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
12.0CPE matchmatch criteria
cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:*
12.0inCPE matchmatch criteria
cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:*
13.0CPE matchmatch criteria
cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:*
13.1CPE matchmatch criteria
cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:*
13.2CPE matchmatch criteria
cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.4
CvssVersion
2.0

Exploit Intelligence

EPSS Score
83.17%
Probability of exploitation in next 30 days
EPSS Percentile
99.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
Metasploit: Apache Commons FileUpload and Apache Tomcat DoS · Feb 6, 2014
ExploitDB: EDB-31615 · Feb 12, 2014
This CVE's current EPSS score of 0.8317 is in the 100th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (40)

mavenpatch availablevia ghsa
Product: commons-fileupload:commons-fileuploadFixed in: 1.3.1
mavenpatch availablevia ghsa
Product: org.apache.tomcat:tomcatFixed in: 7.0.52
mavenpatch availablevia ghsa
Product: org.apache.tomcat:tomcatFixed in: 8.0.3
redhatpatch availablevia redhat_api
Product: Fuse MQ Enterprise 7.1.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: tomcat6-0:6.0.24-64.el6_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss A-MQ 6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss BPMS 6.0Fixed in: jbossweb
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss BRMS 6.0Fixed in: jbossweb
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6.2Fixed in: jbossweb
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5Fixed in: jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6Fixed in: jbossweb-0:7.3.0-2.Final_redhat_2.1.ep6.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: tomcat6-0:6.0.37-19_patch_04.ep6.el5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 5Fixed in: tomcat7-0:7.0.40-13_patch_02.ep6.el5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat6-0:6.0.37-27_patch_04.ep6.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2 for RHEL 6Fixed in: tomcat7-0:7.0.40-9_patch_02.ep6.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse 6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse Service Works 6.0Fixed in: jbossweb
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Operations Network 3.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 2.0Fixed in: tomcat7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 2.0Fixed in: tomcat6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Portal 6.2Fixed in: jbossweb
View patch
redhatpatch availablevia redhat_api
Product: Fuse ESB Enterprise 7.1.0
View patch
redhatpatch availablevia redhat_api
Product: Fuse Management Console 7.1.0
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: jakarta-commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat Software CollectionsFixed in: thermostat1-apache-commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat JBoss BRMS 6Fixed in: commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse Service Works 6Fixed in: commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat JBoss Operations Network 3Fixed in: commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat JBoss Operations Network 3Fixed in: jbossweb
redhatno patchvia redhat_api
Product: Red Hat JBoss Portal 6Fixed in: commons-fileupload
redhatno patchvia redhat_api
Product: Red Hat BPM Suite 6Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat Satellite 5Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss Portal 4Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss Portal 5Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss BRMS 5Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat Satellite 6Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 1Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 1Fixed in: tomcat
redhatend of lifevia redhat_api
Product: Red Hat JBoss SOA Platform 4Fixed in: commons-fileupload
redhatend of lifevia redhat_api
Product: Red Hat JBoss SOA Platform 5Fixed in: commons-fileupload

Vendor Advisories (2)

mavenGHSA-xx68-jfcg-xmmfhigh

Commons FileUpload Denial of service vulnerability

Dec 21, 2018
redhatCVE-2014-0050Moderate

apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream

Feb 6, 2014

References

advisories.mageia.org / MGASA-2014-0110.html
blog.spiderlabs.com / 2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
Exploit
jvndb.jvn.jp / jvndb/JVNDB-2014-000017
jvn.jp / en/jp/JVN14876762/index.html
mail-archives.apache.org / mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E
marc.info
packetstormsecurity.com / files/127215/VMware-Security-Advisory-2014-0007.html
rhn.redhat.com / errata/RHSA-2014-0252.html
rhn.redhat.com / errata/RHSA-2014-0253.html
rhn.redhat.com / errata/RHSA-2014-0400.html
bugzilla.redhat.com / show_bug.cgi
seclists.org / fulldisclosure/2014/Dec/23
secunia.com / advisories/57915
secunia.com / advisories/58075
secunia.com / advisories/58976
secunia.com / advisories/59039
secunia.com / advisories/59041
secunia.com / advisories/59183
secunia.com / advisories/59184
secunia.com / advisories/59185
secunia.com / advisories/59187
secunia.com / advisories/59232
secunia.com / advisories/59399
secunia.com / advisories/59492
secunia.com / advisories/59500
secunia.com / advisories/59725
secunia.com / advisories/60475
secunia.com / advisories/60753
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
security.gentoo.org / glsa/202107-39
svn.apache.org / r1565143
Patch
tomcat.apache.org / security-7.html
PatchVendor Advisory
tomcat.apache.org / security-8.html
PatchVendor Advisory
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
www-01.ibm.com / support/docview.wss
debian.org / security/2014/dsa-2856
hitachi.co.jp / Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html
hitachi.co.jp / Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html
hitachi.co.jp / Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html
huawei.com / en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
mandriva.com / security/advisories
oracle.com / technetwork/security-advisory/cpuoct2016-2881722.html
oracle.com / technetwork/security-advisory/cpuoct2017-3236626.html
oracle.com / technetwork/topics/security/cpuapr2015-2365600.html
oracle.com / technetwork/topics/security/cpujan2015-1972971.html
oracle.com / technetwork/topics/security/cpujan2016-2367955.html
oracle.com / technetwork/topics/security/cpujul2014-1972956.html
oracle.com / technetwork/topics/security/cpuoct2014-1972960.html
oracle.com / technetwork/topics/security/cpuoct2015-2367953.html
securityfocus.com / archive/1/532549/100/0/threaded
securityfocus.com / archive/1/534161/100/0/threaded
securityfocus.com / bid/65400
ubuntu.com / usn/USN-2130-1
vmware.com / security/advisories/VMSA-2014-0007.html
vmware.com / security/advisories/VMSA-2014-0008.html
vmware.com / security/advisories/VMSA-2014-0012.html