CVE-2014-0050

Name of the Vulnerable Software and Affected Versions Apache Commons FileUpload versions prior to 1.3.1

Description The issue allows remote attackers to cause a denial of service via a crafted Content-Type header that bypasses a loop's intended exit conditions, leading to an infinite loop and CPU consumption. This is due to a bug in the MultipartStream.java file. The vulnerability can be exploited by sending a malformed request with a specially crafted Content-Type header.

Recommendations For Apache Commons FileUpload versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the MultipartStream.java file or disabling the processing of mime-multipart requests until a patch is available. Avoid using crafted Content-Type headers in requests to minimize the risk of exploitation.