Description

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Remediation

References

CVE-2016-3092

Related Vulnerabilities

qdPM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2020-26165)

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-37695)

Oracle Database Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-2111)

Ruby Use of Externally-Controlled Format String Vulnerability (CVE-2017-0898)

Ruby Numeric Errors Vulnerability (CVE-2008-2662)

Severity

High

Classification

CVE-2016-3092 CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities