Most recent entries from all

ALSA-2025:14177 — Important: tomcat security update

Affected: AlmaLinux:8: tomcat, AlmaLinux:8: tomcat-admin-webapps, AlmaLinux:8: tomcat-docs-webapp, AlmaLinux:8: tomcat-el-3.0-api, AlmaLinux:8: tomcat-jsp-2.3-api, AlmaLinux:8: tomcat-lib, AlmaLinux:8: tomcat-servlet-4.0-api, AlmaLinux:8: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988) * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976) * tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) * tomcat: Apache Tomcat denial of service (CVE-2025-52520) * tomcat: Apache Tomcat denial of service (CVE-2025-52434) * tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-07776

certfr-2025-avi-0516 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un dén…

certfr-2025-avi-0516

EUVD-2026-257966

fkie_cve-2025-48976

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

GHSA-vv7r-c36w-3prj — Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Affected: Maven: commons-fileupload:commons-fileupload, Maven: org.apache.commons:commons-fileupload2-core

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

ICSA-25-254-06 — Siemens Industrial Edge Management

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

jvndb-2025-000044

Multiple Apache products provided by The Apache Software Foundation contain vulnerabilities listed below. <ul><li>Allocation of resources without limits or throttling (CWE-770) - CVE-2025-48976, CVE-2025-48988</li></ul> TERASOLUNA Framework Security Team of NTT DATA Group Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten

NCSC-2026-0022

OESA-2025-1706 — apache-commons-fileupload security update

Affected: openEuler:22.03-LTS-SP4: apache-commons-fileupload, openEuler:24.03-LTS: apache-commons-fileupload, openEuler:24.03-LTS-SP1: apache-commons-fileupload, openEuler:20.03-LTS-SP4: apache-commons-fileupload, openEuler:22.03-LTS-SP3: apache-commons-fileupload

The javax.servlet package lacks support for RFC-1867, HTML file upload. This package provides a simple to use API for working with such data. The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest. Security Fix(es):

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)

openSUSE-SU-2025:15208-1 — apache-commons-fileupload-1.6.0-1.1 on GA media

apache-commons-fileupload-1.6.0-1.1 on GA media

RHSA-2025:11695 — Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update

apache-commons-fileupload: Apache Commons FileUpload DoS via part headers tomcat: Apache Tomcat DoS in multipart upload tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources tomcat: Apache Tomcat denial of service tomcat: Apache Tomcat denial of service tomcat: Apache Tomcat denial of service

SUSE-SU-2025:02184-1 — Security update for jakarta-commons-fileupload

Security update for jakarta-commons-fileupload

UBUNTU-CVE-2025-48976

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:16.04:LTS: libcommons-fileupload-java, Ubuntu:18.04:LTS: libcommons-fileupload-java, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:20.04:LTS: libcommons-fileupload-java, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:22.04:LTS: libcommons-fileupload-java, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: libcommons-fileupload-java, Ubuntu:24.04:LTS: tomcat10 and 6 more

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.

WID-SEC-W-2025-1334 — Apache Commons FileUpload: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons FileUpload ausnutzen, um einen Denial of Service Angriff durchzuführen.