7.5

CVE-2014-0050: apache commons_fileupload

Modified
AliasesMGASA-2014-0109MGASA-2014-0110RHSA-2014:0253
Published 28-03-2014Last modified 07-10-2026

Vulnerability summary

CVE-2014-0050 is a high (CVSS 7.5) vulnerability in apache commons_fileupload. EPSS estimates a 83.33% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 06-02-2014)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
83.33%
0%100%
Critical · +0.16 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 7 · Related 3
DSA-2897-1OPENSUSE-SU-2024:10446-1OPENSUSE-SU-2024:10620-1OPENSUSE-SU-2024:13441-1RHSA-2014:0429RHSA-2014:0525

Timeline

  1. 28-03-2014
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

83.33%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +0.16 pp

From 83.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (blog.spiderlabs.com)

    Maturity: unknown

  • exploit-databasedosmultipleVerified

    Apache Commons FileUpload and Apache Tomcat - Denial of Service

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Apache Commons FileUpload and Apache Tomcat DoS

    auxiliary/dos/http/apache_commons_fileupload_dos

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Mageia4 products
  • apache-commons-fileupload< 1.2.2-10.1.mga3
  • tomcat< 7.0.41-5.mga3
  • apache-commons-fileupload< 1.3-5.1.mga4
  • tomcat< 7.0.47-1.2.mga4
Apache2 products
  • commons_fileupload≤ 1.3 | 1.0 | 1.1 | 1.1.1 | 1.2 | 1.2.1 | 1.2.2
  • tomcatEOL7.0.0 | 7.0.0:beta | 7.0.1 | 7.0.2 | 7.0.2:beta | 7.0.3 | 7.0.4 | 7.0.4:beta | 7.0.5 | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.13 | 7.0.14 | 7.0.15 | 7.0.16 | 7.0.17 | 7.0.18 | 7.0.19 | 7.0.20 | 7.0.21 | 7.0.22 | 7.0.23 | 7.0.24 | 7.0.25 | 7.0.26 | 7.0.27 | 7.0.28 | 7.0.29 | 7.0.30 | 7.0.31 | 7.0.32 | 7.0.33 | 7.0.34 | 7.0.35 | 7.0.36 | 7.0.37 | 7.0.38 | 7.0.39 | 7.0.40 | 7.0.41 | 7.0.42 | 7.0.43 | 7.0.44 | 7.0.45 | 7.0.46 | 7.0.47 | 7.0.48 | 7.0.49 | 7.0.50 | 8.0.0:rc1 | 8.0.0:rc10 | 8.0.0:rc2 | 8.0.0:rc5 | 8.0.1
Ubuntu2 products
  • libcommons-fileupload-java< 1.3.1-1
  • tomcat7< 7.0.52-1
Commons-fileupload1 product
  • commons-fileupload< 1.3.1
Debian1 product
  • libcommons-fileupload-java< 1.2.2-1+deb6u2 | < 1.2.2-1+deb7u2 | < 1.3.1-1
Oracle1 product
Org.apache.tomcat1 product
  • tomcat≥ 8.0.0-RC1, < 8.0.3 | ≥ 7.0.0, < 7.0.52
Redhat1 product
  • jbossweb< 0:7.3.0-2.Final_redhat_2.1.ep6.el5 | < 0:7.3.0-2.Final_redhat_2.1.ep6.el6

8 vendors · 13 products

References

95 links
Show all 95 references