Skip to content

01 Record

CVE-2014-0050

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU

HighPUBLISHEDCNA: redhat

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

02 Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

83.33% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.6% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-07.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2014-03-28 19:00Z12 YR AGO

Last updated

2026-10-07 17:58Z22 DAYS AGO

Reserved

2013-12-03

Assigning CNA

redhat

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')Base
CWE-264

Data version

5.2

Document digest

c6eb593394ea5a9ec468e68053134708f18fdd344786827720a4f3b1d86a870b

05 Affected products

VendorProductVersionsPlatforms

apachecommons_fileuploadNot specified—

apachetomcatNot specified—

oracleretail_applicationsNot specified—

redhatenterprise_linuxNot specified—

redhatfuse_esb_enterpriseNot specified—

redhatfuse_management_consoleNot specified—

redhatfuse_mq_enterpriseNot specified—

redhatjboss_amqNot specified—

redhatjboss_bpmsNot specified—

redhatjboss_brmsNot specified—

redhatjboss_data_gridNot specified—

redhatjboss_data_virtualizationNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_bpms_platformNot specified—

redhatjboss_enterprise_brms_platformNot specified—

redhatjboss_enterprise_portal_platformNot specified—

redhatjboss_enterprise_soa_platformNot specified—

redhatjboss_enterprise_web_serverNot specified—

redhatjboss_fuseNot specified—

redhatjboss_fuse_service_worksNot specified—

redhatjboss_operations_networkNot specified—

redhatnetwork_satelliteNot specified—

redhatrhel_software_collectionsNot specified—

redhatsatelliteNot specified—

06 References

packetstormsecurity.comhttp://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlx_refsource_MISC
www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0008.htmlx_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676656x_refsource_CONFIRM
jvn.jpJVN#14876762http://jvn.jp/en/jp/JVN14876762/index.htmlthird-party-advisoryx_refsource_JVN
marc.infoHPSBGN03329http://marc.info/?l=bugtraq&m=143136844732487&w=2vendor-advisoryx_refsource_HP
secunia.com60753http://secunia.com/advisories/60753third-party-advisoryx_refsource_SECUNIA
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1062337x_refsource_CONFIRM
secunia.com59184http://secunia.com/advisories/59184third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677691x_refsource_CONFIRM
www.debian.orgDSA-2856http://www.debian.org/security/2014/dsa-2856vendor-advisoryx_refsource_DEBIAN
secunia.com59039http://secunia.com/advisories/59039third-party-advisoryx_refsource_SECUNIA
secunia.com59185http://secunia.com/advisories/59185third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676401x_refsource_CONFIRM
www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0012.htmlx_refsource_CONFIRM
secunia.com58075http://secunia.com/advisories/58075third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676853x_refsource_CONFIRM
secunia.com59187http://secunia.com/advisories/59187third-party-advisoryx_refsource_SECUNIA
secunia.com59041http://secunia.com/advisories/59041third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676092x_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21681214x_refsource_CONFIRM
www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2014-0007.htmlx_refsource_CONFIRM
secunia.com60475http://secunia.com/advisories/60475third-party-advisoryx_refsource_SECUNIA
svn.apache.orghttp://svn.apache.org/r1565143x_refsource_CONFIRM
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlx_refsource_CONFIRM
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917x_refsource_CONFIRM
advisories.mageia.orghttp://advisories.mageia.org/MGASA-2014-0110.htmlx_refsource_CONFIRM
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755x_refsource_CONFIRM
blog.spiderlabs.comhttp://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlx_refsource_MISC
www.mandriva.comMDVSA-2015:084http://www.mandriva.com/security/advisories?name=MDVSA-2015:084vendor-advisoryx_refsource_MANDRIVA
www.hitachi.co.jphttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.htmlx_refsource_CONFIRM
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlx_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676410x_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676405x_refsource_CONFIRM
tomcat.apache.orghttp://tomcat.apache.org/security-7.htmlx_refsource_CONFIRM
secunia.com59492http://secunia.com/advisories/59492third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitieshttp://www.securityfocus.com/archive/1/534161/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlx_refsource_CONFIRM
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlx_refsource_CONFIRM
secunia.com59500http://secunia.com/advisories/59500third-party-advisoryx_refsource_SECUNIA
secunia.com59183http://secunia.com/advisories/59183third-party-advisoryx_refsource_SECUNIA
tomcat.apache.orghttp://tomcat.apache.org/security-8.htmlx_refsource_CONFIRM
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlx_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676403x_refsource_CONFIRM
www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlx_refsource_CONFIRM
rhn.redhat.comRHSA-2014:0252http://rhn.redhat.com/errata/RHSA-2014-0252.htmlvendor-advisoryx_refsource_REDHAT
www.huawei.comhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htmx_refsource_CONFIRM
jvndb.jvn.jpJVNDB-2014-000017http://jvndb.jvn.jp/jvndb/JVNDB-2014-000017third-party-advisoryx_refsource_JVNDB
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlx_refsource_CONFIRM
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722x_refsource_CONFIRM
www.ubuntu.comUSN-2130-1http://www.ubuntu.com/usn/USN-2130-1vendor-advisoryx_refsource_UBUNTU
www.securityfocus.com65400http://www.securityfocus.com/bid/65400vdb-entryx_refsource_BID
rhn.redhat.comRHSA-2014:0400http://rhn.redhat.com/errata/RHSA-2014-0400.htmlvendor-advisoryx_refsource_REDHAT
secunia.com59725http://secunia.com/advisories/59725third-party-advisoryx_refsource_SECUNIA
seclists.org20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitieshttp://seclists.org/fulldisclosure/2014/Dec/23mailing-listx_refsource_FULLDISC
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21675432x_refsource_CONFIRM
secunia.com57915http://secunia.com/advisories/57915third-party-advisoryx_refsource_SECUNIA
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlx_refsource_CONFIRM
secunia.com59399http://secunia.com/advisories/59399third-party-advisoryx_refsource_SECUNIA
mail-archives.apache.org[commons-dev] 20140206 [SECURITY] CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat DoShttp://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3Emailing-listx_refsource_MLIST
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21676091x_refsource_CONFIRM
secunia.com58976http://secunia.com/advisories/58976third-party-advisoryx_refsource_SECUNIA
www.hitachi.co.jphttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.htmlx_refsource_CONFIRM
rhn.redhat.comRHSA-2014:0253http://rhn.redhat.com/errata/RHSA-2014-0253.htmlvendor-advisoryx_refsource_REDHAT
secunia.com59232http://secunia.com/advisories/59232third-party-advisoryx_refsource_SECUNIA
www.hitachi.co.jphttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.htmlx_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21677724x_refsource_CONFIRM
www.securityfocus.com20140625 NEW VMSA-2014-0007 - VMware product updates address security vulnerabilities in Apache Struts libraryhttp://www.securityfocus.com/archive/1/532549/100/0/threadedmailing-listx_refsource_BUGTRAQ
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21669554x_refsource_CONFIRM
security.gentoo.orgGLSA-202107-39https://security.gentoo.org/glsa/202107-39vendor-advisoryx_refsource_GENTOO

07 Fixed in

Debian 12

libcommons-fileupload-java
Fixed in 1.3.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

libcommons-fileupload-java
Fixed in 1.3.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

libcommons-fileupload-java
Fixed in 1.3.1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.