CVE-2025-48976

61

FAUCET Score

CVE-2025-48976 describes a Denial of Service (DoS) vulnerability in Apache Commons FileUpload, affecting versions 1.0 through 1.5 and 2.0.0-M1 through 2.0.0-M3. This flaw stems from insufficient limits on resource allocation for multipart headers, allowing an attacker to exhaust system resources. With a CVSS score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity, potentially leading to a complete service disruption. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.0, < 1.6CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload::::::::
		2.0.0CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload:2.0.0:m1::::::
		2.0.0CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload:2.0.0:m1-rc1::::::
		2.0.0CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload:2.0.0:m2::::::
		2.0.0CPE matchmatch criteria	cpe:2.3:a:apache:commons_fileupload:2.0.0:m2-rc1::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

67.27%

Probability of exploitation in next 30 days

EPSS Percentile

99.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.6727 is in the 99th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (44)

mavenpatch availablevia ghsa

Product: org.apache.commons:commons-fileupload2-coreFixed in: 2.0.0-M4

mavenpatch availablevia ghsa

Product: commons-fileupload:commons-fileuploadFixed in: 1.6.0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: tomcat9-1:9.0.87-5.el10_0.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 10Fixed in: tomcat-1:10.1.36-1.el10_0.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: tomcat-1:9.0.87-1.el8_10.6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: tomcat-1:9.0.87-1.el8_8.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: tomcat-1:9.0.87-1.el8_8.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: tomcat-1:9.0.87-3.el9_6.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: tomcat-1:9.0.87-1.el9_2.6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: tomcat-1:9.0.87-1.el9_4.6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.8.5Fixed in: tomcat

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.8 on RHEL 7Fixed in: jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.8 on RHEL 8Fixed in: jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 5.8 on RHEL 9Fixed in: jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 6.1.1Fixed in: tomcat

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 6.1 on RHEL 10Fixed in: jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 6.1 on RHEL 8Fixed in: jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Web Server 6.1 on RHEL 9Fixed in: jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws

redhatvendor investigatingvia redhat_api

Product: A-MQ Clients 2Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: OpenShift Developer Tools and ServicesFixed in: jenkins

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: commons-fileupload2-core

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: commons-fileupload2-jakarta

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Apicurio Registry 2Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Apicurio Registry 3Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Debezium 2Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat build of Debezium 3Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat Data Grid 8Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-assembly-plugin

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: pki-deps:10.6/pki-servlet-engine

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: pki-servlet-engine

redhatvendor investigatingvia redhat_api

Product: Red Hat Fuse 7Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat Integration Camel K 1Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/server-rhel8

redhatvendor investigatingvia redhat_api

Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/server-rhel9

redhatvendor investigatingvia redhat_api

Product: Red Hat Process Automation 7Fixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: Red Hat Satellite 6Fixed in: puppetserver

redhatvendor investigatingvia redhat_api

Product: Red Hat Satellite 6Fixed in: satellite-capsule:el8/puppetserver

redhatvendor investigatingvia redhat_api

Product: Red Hat Satellite 6Fixed in: satellite:el8/puppetserver

redhatvendor investigatingvia redhat_api

Product: streams for Apache KafkaFixed in: commons-fileupload

redhatvendor investigatingvia redhat_api

Product: streams for Apache Kafka 2Fixed in: commons-fileupload

Vendor Advisories (2)

mavenGHSA-vv7r-c36w-3prjhigh

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

redhatCVE-2025-48976Moderate

apache-commons-fileupload: Apache Commons FileUpload DoS via part headers

References

lists.debian.org / debian-lts-announce/2025/07/msg00008.html

lists.debian.org / debian-lts-announce/2025/07/msg00009.html

openwall.com / lists/oss-security/2025/06/16/4

Mailing ListThird Party Advisory

lists.apache.org / thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12

Mailing ListVendor Advisory