UpHeron
All vulnerabilities

Servers and applications

CVE-2016-3092

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Severity
High 7.5
Published
4 Jul 2016
Last changed
7 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone1
All 86 release lines
  • Version 7.0.0-beta
  • Version 7.0.0
  • Version 7.0.1
  • Version 7.0.2-beta
  • Version 7.0.2
  • Version 7.0.4-beta
  • Version 7.0.4
  • Version 7.0.5-beta
  • Version 7.0.5
  • Version 7.0.6
  • Version 7.0.8
  • Version 7.0.10
  • Version 7.0.11
  • Version 7.0.12
  • Version 7.0.14
  • Version 7.0.16
  • Version 7.0.19
  • Version 7.0.20
  • Version 7.0.21
  • Version 7.0.22
  • Version 7.0.23
  • Version 7.0.25
  • Version 7.0.26
  • Version 7.0.27
  • Version 7.0.28
  • Version 7.0.29
  • Version 7.0.30
  • Version 7.0.32
  • Version 7.0.33
  • Version 7.0.34
  • Version 7.0.35
  • Version 7.0.37
  • Version 7.0.39
  • Version 7.0.40
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.47
  • Version 7.0.50
  • Version 7.0.52
  • Version 7.0.53
  • Version 7.0.54
  • Version 7.0.55
  • Version 7.0.56
  • Version 7.0.57
  • Version 7.0.59
  • Version 7.0.61
  • Version 7.0.62
  • Version 7.0.63
  • Version 7.0.64
  • Version 7.0.65
  • Version 7.0.67
  • Version 7.0.68
  • Version 7.0.69
  • Version 8.0.0-rc1
  • Version 8.0.0-rc2
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0.1
  • Version 8.0.3
  • Version 8.0.5
  • Version 8.0.8
  • Version 8.0.11
  • Version 8.0.12
  • Version 8.0.14
  • Version 8.0.15
  • Version 8.0.17
  • Version 8.0.18
  • Version 8.0.20
  • Version 8.0.21
  • Version 8.0.22
  • Version 8.0.23
  • Version 8.0.24
  • Version 8.0.26
  • Version 8.0.27
  • Version 8.0.28
  • Version 8.0.29
  • Version 8.0.30
  • Version 8.0.32
  • Version 8.0.33
  • Version 8.0.35
  • Version 8.5.0
  • Version 8.5.2
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3092
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3092