Threats affecting pkg:maven/org.apache.commons/commons-fileupload

A denial of service (DoS) vulnerability exists in Apache Commons FileUpload due to allocation of resources for multipart headers with insufficient limits. This affects Apache Commons FileUpload versions from 1.0 before 1.6 and from 2.0.0-M1 before 2.0.0-M4. Users are advised to upgrade to versions 1.6 or 2.0.0-M4 to remediate the issue. The vulnerability impacts various Tomcat6 versions that include affected Apache Commons FileUpload versions. The vulnerability allows an attacker to cause a denial of service by exhausting resources during multipart header processing.

Apache Commons FileUpload versions before 1.5 do not impose limits on the number of request parts processed, allowing an attacker to potentially trigger a denial-of-service (DoS) condition by sending malicious uploads or multiple uploads. The mitigation involves configuring the new FileUploadBase#setFileCountMax option introduced in version 1.5, which is not enabled by default.