CVE-2025-48976

This is a flaw in software that helps websites receive uploaded files. An attacker can send specially formed upload information that consumes too many server resources, like repeatedly stuffing oversized paperwork into a reception desk until staff cannot handle normal customers.

This matters to you if an application you run uses Apache Commons FileUpload to process file uploads or web forms with attachments. It is most relevant where untrusted people can send uploads to your application.

Attackers can remotely make a vulnerable application unavailable by sending oversized upload metadata, so treat this as an amber-priority update. It is not listed in CISA's catalog of vulnerabilities known to be actively exploited, and no public exploit code is on record, but the predicted likelihood of exploitation is high and rising.

Confirm exposure by inventorying application dependencies, deployed JARs, container images, and Maven lock/build files for commons-fileupload:commons-fileupload or org.apache.commons:commons-fileupload2-core. The affected ranges are 1.x before 1.6.0 and 2.x from 2.0.0-M1 before 2.0.0-M4.

For the 1.x branch, upgrade to commons-fileupload:commons-fileupload 1.6.0 or later. For the 2.x branch, upgrade org.apache.commons:commons-fileupload2-core to 2.0.0-M4 or later; test the upgrade in staging because moving between major branches may require application code changes.

If patching is delayed, place strict request and multipart-header limits at the reverse proxy, web server, or application gateway, and restrict upload endpoints to trusted users or networks where feasible. Monitor application and proxy logs for unusually large multipart headers, repeated failed upload requests, elevated memory use, worker exhaustion, and upload-service outages. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

CVSS v3.1: 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CWE-770: allocation of resources without sufficient limits during multipart part-header processing, enabling a remote denial of service. No CISA KEV listing, no public exploit code recorded, and no confirmed in-the-wild exploitation in the findings. EPSS is 33.0% (98th percentile) and rising; this is a prediction, not evidence of exploitation.