{"answers":{"affected":"6 open source packages ship an affected version, including org.apache.tomcat:tomcat and commons-fileupload:commons-fileupload. It affects 3 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0050 exists.","fix":"Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 7.0.52 or 8.0.3.","what":"CVE-2014-0050 is a high-severity denial of service vulnerability in Apache Tomcat, published on 28 Mar 2014. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2014-0050 and fix it if it is affected.\n\nWhat it is: CVE-2014-0050 is a high-severity denial of service vulnerability in Apache Tomcat, published on 28 Mar 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0050 exists.\n\nAffected packages and fixed versions:\n- org.apache.tomcat:tomcat (Maven): affected from 7.0.0; fixed in 7.0.52\n- org.apache.tomcat:tomcat (Maven): affected from 7.0.0; fixed in 7.0.52\n- org.apache.tomcat:tomcat (Maven): affected from 8.0.0-RC1; fixed in 8.0.3\n- org.apache.tomcat:tomcat (Maven): affected from 8.0.0-RC1; fixed in 8.0.3\n- commons-fileupload:commons-fileupload (Maven): affected all versions; fixed in 1.3.1\n- commons-fileupload:commons-fileupload (Maven): affected all versions; fixed in 1.3.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2014-0050/ (Markdown: https://insights.sbomify.com/CVE-2014-0050/index.md)","id":"CVE-2014-0050","markdown":"https://insights.sbomify.com/CVE-2014-0050/index.md","name":"CVE-2014-0050","record":{"aliases":["DEBIAN-CVE-2014-0050","DSA-2856-1","GHSA-xx68-jfcg-xmmf","MGASA-2014-0109","MGASA-2014-0110","RHSA-2014:0253"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Java file upload library","requires_auth":"none","summary":"Remote attackers can cause denial of service via infinite loop in Apache Commons FileUpload using crafted Content-Type headers.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"commons_fileupload","vendor":"apache"},{"product":"tomcat","vendor":"apache"},{"product":"retail_applications","vendor":"oracle"}],"cvss":{"score":7.5,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-264","name":null},{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","ecosystems":["Maven","Red Hat:jboss_enterprise_application_platform:6::el5","Red Hat:jboss_enterprise_application_platform:6::el6"],"exploits":{"exploitdb":1,"first_seen":"2014-02-06","github_poc":1,"max_poc_stars":1,"metasploit":1,"nuclei":0,"refs":[{"date":"2017-03-15T04:59:23Z","kind":"github_poc","ref":"https://github.com/jrrdev/cve-2014-0050","stars":1,"title":"CVE-2014-0050 Vulnerable site sample"},{"date":"2014-02-06","kind":"metasploit","ref":"auxiliary/dos/http/apache_commons_fileupload_dos","stars":null,"title":"Apache Commons FileUpload and Apache Tomcat DoS"},{"date":"2014-02-12","kind":"exploitdb","ref":"31615","stars":null,"title":"Apache Commons FileUpload and Apache Tomcat - Denial of Service"}],"tier":"weaponised"},"has_fix":true,"headline":"Commons FileUpload Denial of service vulnerability","id":"CVE-2014-0050","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":"apache:tomcat","products":["apache:tomcat"],"type":"denial_of_service","year":"2014"},"n_packages":8,"n_references":69,"next":{"headline":"DO NOT USE THIS CANDIDATE NUMBER.","id":"CVE-2014-0051"},"packages":[{"ecosystem":"Maven","fixed":["1.3.1"],"introduced":["0"],"last_affected":[],"package":"commons-fileupload:commons-fileupload","purl":null,"source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Maven","fixed":["1.3.1"],"introduced":["0"],"last_affected":[],"package":"commons-fileupload:commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload","source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Maven","fixed":["7.0.52"],"introduced":["7.0.0"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Maven","fixed":["7.0.52"],"introduced":["7.0.0"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Maven","fixed":["8.0.3"],"introduced":["8.0.0-RC1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":null,"source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Maven","fixed":["8.0.3"],"introduced":["8.0.0-RC1"],"last_affected":[],"package":"org.apache.tomcat:tomcat","purl":"pkg:maven/org.apache.tomcat/tomcat","source":"GHSA-xx68-jfcg-xmmf"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","fixed":["0:7.3.0-2.Final_redhat_2.1.ep6.el5"],"introduced":["0"],"last_affected":[],"package":"jbossweb","purl":"pkg:rpm/redhat/jbossweb","source":"RHSA-2014:0253"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","fixed":["0:7.3.0-2.Final_redhat_2.1.ep6.el6"],"introduced":["0"],"last_affected":[],"package":"jbossweb","purl":"pkg:rpm/redhat/jbossweb","source":"RHSA-2014:0253"}],"prev":{"headline":"Memory corruption in n/a","id":"CVE-2014-0049"},"products":["n/a"],"published":"2014-03-28","related":[{"cvss_score":9.8,"headline":"Improper Access Control in commons-fileupload","id":"CVE-2016-1000031","kev_date_added":null,"published":"2016-10-25"},{"cvss_score":7.5,"headline":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","id":"CVE-2025-48976","kev_date_added":null,"published":"2025-06-16"},{"cvss_score":7.5,"headline":"Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts","id":"CVE-2023-24998","kev_date_added":null,"published":"2023-02-20"},{"cvss_score":7.5,"headline":"High severity vulnerability that affects commons-fileupload:commons-fileupload","id":"CVE-2016-3092","kev_date_added":null,"published":"2016-07-04"},{"cvss_score":6.8,"headline":"Incorrect Default Permissions in Apache Commons FileUpload","id":"CVE-2013-0248","kev_date_added":null,"published":"2013-03-15"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-07","vendors":["n/a"]},"summary":"Remote attackers can cause denial of service via infinite loop in Apache Commons FileUpload using crafted Content-Type headers.","url":"https://insights.sbomify.com/CVE-2014-0050/"}