{"id":"CVE-2014-0050","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-0050","generatedAt":"2026-10-27T18:47:19.528Z","title":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that…","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","published":"2014-04-01T06:27:51.000Z","lastModified":"2026-10-07T18:17:05.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-264","CWE-835"],"affected":["oracle/retail applications","apache/commons fileupload","apache/tomcat"],"epss":{"score":0.83334,"percentile":0.99677,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2014-02-12","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":31615,"kind":"exploit","title":"Apache Commons FileUpload and Apache Tomcat - Denial of Service","url":"https://www.exploit-db.com/exploits/31615","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/31615.rb","file":"exploits/multiple/dos/31615.rb","published":"2014-02-12","added":"2014-02-12","updated":"2014-02-12","author":"Trustwave's SpiderLabs","type":"dos","platform":"multiple","port":null,"verified":true,"codes":["CVE-2014-0050","OSVDB-102945"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 83.3%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://advisories.mageia.org/MGASA-2014-0110.html","source":"secalert@redhat.com"},{"url":"http://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html","tags":["Exploit"],"source":"secalert@redhat.com"},{"url":"http://jvn.jp/en/jp/JVN14876762/index.html","source":"secalert@redhat.com"},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017","source":"secalert@redhat.com"},{"url":"http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3E","source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=143136844732487&w=2","source":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0252.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0253.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0400.html","source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/57915","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/58075","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/58976","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59039","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59041","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59183","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59184","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59185","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59187","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59232","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59399","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59492","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59500","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59725","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/60475","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/60753","source":"secalert@redhat.com"},{"url":"http://svn.apache.org/r1565143","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"http://tomcat.apache.org/security-7.html","tags":["Patch","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://tomcat.apache.org/security-8.html","tags":["Patch","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21669554","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21675432","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676091","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676092","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676401","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676403","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676405","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676410","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676656","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676853","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677691","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677724","source":"secalert@redhat.com"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21681214","source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2014/dsa-2856","source":"secalert@redhat.com"},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.html","source":"secalert@redhat.com"},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.html","source":"secalert@redhat.com"},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.html","source":"secalert@redhat.com"},{"url":"http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm","source":"secalert@redhat.com"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:084","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/archive/1/532549/100/0/threaded","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/65400","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0050","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}