Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-48976. PoCs published by nankuo, Samb102.
AI-analyzed exploit summary The PoC demonstrates a DoS vulnerability by sending maliciously crafted multipart/form-data requests with excessive headers and parts to overwhelm the target server. It targets a JSP upload endpoint, likely exploiting a resource exhaustion flaw.
Description
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Exploits (2)
The PoC demonstrates a DoS vulnerability by sending maliciously crafted multipart/form-data requests with excessive headers and parts to overwhelm the target server. It targets a JSP upload endpoint, likely exploiting a resource exhaustion flaw.
This repository contains a functional proof-of-concept exploit for CVE-2025-48988 and CVE-2025-48976, targeting a DoS vulnerability in Tomcat 10.1.41 via crafted multipart requests. The exploit sends high-volume multipart requests to trigger excessive CPU usage, with a Docker setup for testing and remediation guidance.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H