CVE-2014-0050
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
- CVSS 3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- 83% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-264, CWE-835
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:commons_fileupload
- apache:tomcat
- oracle:retail_applications
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xx68-jfcg-xmmf | Maven | commons-fileupload:commons-fileupload | <1.3.1 | 1.3.1 |
| GHSA-xx68-jfcg-xmmf | Maven | org.apache.tomcat:tomcat | >=8.0.0-RC1 <8.0.3 | 8.0.3 |
| GHSA-xx68-jfcg-xmmf | Maven | org.apache.tomcat:tomcat | >=7.0.0 <7.0.52 | 7.0.52 |
References
- http://advisories.mageia.org/MGASA-2014-0110.html
- http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html
- http://jvn.jp/en/jp/JVN14876762/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017
- http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E