CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 37.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 37.17% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- hp/icewall identity manager · hp/icewall sso agent option · apache/tomcat · debian/debian linux · apache/commons fileupload · canonical/ubuntu linux
- Source
- secalert@redhat.com
EPSS moved from 29.7% on 21 September 2026 to 37.2% on 4 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- http://jvn.jp/en/jp/JVN89379547/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121VDB Entry, Vendor Advisory
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3EMailing List
- http://rhn.redhat.com/errata/RHSA-2016-2068.html
- http://rhn.redhat.com/errata/RHSA-2016-2069.html
- http://rhn.redhat.com/errata/RHSA-2016-2070.html
- http://rhn.redhat.com/errata/RHSA-2016-2071.html
- http://rhn.redhat.com/errata/RHSA-2016-2072.html
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://svn.apache.org/viewvc?view=revision&revision=1743480
- http://svn.apache.org/viewvc?view=revision&revision=1743722Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1743738Vendor Advisory
- http://svn.apache.org/viewvc?view=revision&revision=1743742Vendor Advisory
- http://tomcat.apache.org/security-7.htmlVendor Advisory
- http://tomcat.apache.org/security-8.htmlVendor Advisory
- http://tomcat.apache.org/security-9.htmlVendor Advisory
- http://www.debian.org/security/2016/dsa-3609Third Party Advisory
- http://www.debian.org/security/2016/dsa-3611Third Party Advisory
- http://www.debian.org/security/2016/dsa-3614Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securityfocus.com/bid/91453Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036427
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.