Vulnerability record · CVE-2014-0050 · published 1 April 2014
CVE-2014-0050: Apache Commons FileUpload Content-Type header denial of service
Oracle · Retail Applications
MultipartStream.java in Apache Commons FileUpload before 1.3.1 fails to properly terminate a parsing loop when handling a crafted Content-Type header, causing an infinite loop and sustained CPU consumption. The library is embedded in Apache Tomcat, JBoss Web and other products, so the flaw affects any multipart upload endpoint built on those stacks. It matters because a single malformed request can exhaust server CPU and deny service to legitimate users.
Description
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote denial of service with a very high EPSS score and public exploit code, though not listed in KEV.
What it is
MultipartStream.java in Apache Commons FileUpload before 1.3.1 fails to properly terminate a parsing loop when handling a crafted Content-Type header, causing an infinite loop and sustained CPU consumption. The library is embedded in Apache Tomcat, JBoss Web and other products, so the flaw affects any multipart upload endpoint built on those stacks. It matters because a single malformed request can exhaust server CPU and deny service to legitimate users.
Impact
An unauthenticated remote attacker can pin CPU on the affected server, degrading or halting request processing for other users. The record describes denial of service only; no data disclosure or code execution is stated.
Attack surface
Reached over the network by sending an HTTP request with a crafted multipart Content-Type header to an endpoint that parses multipart uploads. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.82766, 99.65th percentile) and a public exploit write-up is referenced, so exploitation is likely and widespread scanning should be assumed.
What to do
- Upgrade Apache Commons FileUpload to 1.3.1 or later, and apply the corresponding Tomcat, JBoss Web or vendor patches that bundle the fixed library.
- Inventory applications and embedded libraries for Commons FileUpload versions below 1.3.1, including transitive dependencies.
- Where immediate upgrade is not possible, apply vendor workarounds or restrict multipart upload endpoints to trusted networks.
- Enforce request size and rate limits at the reverse proxy or WAF to blunt CPU exhaustion from repeated malformed requests.
Detection
- Monitor for sustained high CPU on application or Tomcat hosts correlated with multipart POST requests.
- Alert on repeated requests with malformed or unusual multipart Content-Type boundary values.
- Review web access logs for bursts of multipart upload requests from single sources or with abnormal boundary strings.
- Track thread dumps or stack traces showing MultipartStream parsing loops during CPU spikes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-0050 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-0050), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
