CVE-2025-48976

Apache Commons FileUpload allocates resources for multipart request headers without sufficient limits (CWE-770), allowing a remote, unauthenticated attacker to exhaust server memory or CPU by sending crafted multipart uploads to any endpoint that parses file uploads with the library. The impact is denial of service only; confidentiality and integrity are unaffected (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Any Java application or product bundling Commons FileUpload versions 1.0 through 1.5 or 2.0.0-M1 through 2.0.0-M3 is affected, which spans a very large population of web applications, frameworks, and products that embed the library. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 62.6% probability of exploitation within 30 days (99th percentile), indicating elevated near-term risk.

What to do: Upgrade to Commons FileUpload 1.6 (for the 1.x line) or 2.0.0-M4 (for the 2.0.0-M line). Audit Maven/Gradle dependency trees for commons-fileupload as a direct or transitive dependency and rebuild and redeploy affected services, including third-party Java products that embed it. Where immediate upgrade is not possible, enforce request-body and multipart header limits at a reverse proxy or application server layer and monitor availability, given the high EPSS probability of exploitation.