Loading story…
Red Hat and Apache addressed CVE-2014-0050, a denial-of-service flaw in Apache Commons FileUpload and its bundled copies in Apache Tomcat. An unauthenticated attacker could send a multipart request with a malformed or oversized Content-Type header, causing MultipartStream to enter an infinite loop and exhaust service availability. Affected upstream releases included Commons FileUpload 1.0–1.3, Tomcat 7.0.0–7.0.50, and Tomcat 8.0.0-RC1–8.0.1.
Red Hat issued Moderate-severity updates for JBoss EAP 6.2.1/JBoss Web and incorporated the fix into JBoss A-MQ 6.1.0, alongside other security corrections. Organizations should install the relevant vendor updates, reconcile any locally modified configurations, and restart JBoss services; where patching cannot occur immediately, limiting Content-Type headers to fewer than 4,091 bytes reduces exposure. Upstream remediation includes Commons FileUpload 1.3.1, Tomcat 7.0.51, or Tomcat 8.0.2 and later.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat released a Moderate-severity JBoss EAP update for Red Hat Enterprise Linux 5 and 6, including fixed jbossweb packages for CVE-2014-0050. Red Hat instructed customers to update and restart the JBoss server process.
Red Hat issued a Moderate-impact update for JBoss Enterprise Application Platform 6.2.1 that fixed CVE-2014-0050 in the embedded Apache Commons FileUpload component. The flaw allowed a remote multipart request with a malformed Content-Type header to make JBoss Web loop indefinitely.
Mark Thomas published an advisory describing CVE-2014-0050, which affects Commons FileUpload 1.0 through 1.3 and bundled copies in Tomcat 7 and 8. Apache recommended upgrades, patches, or limiting Content-Type headers to fewer than 4,091 bytes as mitigation.
Red Hat addressed CVE-2014-0050 for JBoss Portal 6.2.0 through RHSA-2015:1009.
Red Hat addressed CVE-2014-0050 for JBoss Enterprise Web Server 2.0.1 through RHSA-2014:0527 and RHSA-2014:0528, and for JBoss Enterprise Web Server 2 on RHEL 5 and 6 through RHSA-2014:0525 and RHSA-2014:0526.
Red Hat addressed CVE-2014-0050 in Red Hat JBoss Operations Network 3.2.1 through RHSA-2014:0473.
Red Hat addressed CVE-2014-0050 for Red Hat JBoss Fuse Service Works 6.0.0 through RHSA-2014:0459.
Red Hat addressed CVE-2014-0050 in Fuse ESB Enterprise/MQ Enterprise 7.1.0 R1 P3 through RHSA-2014:0452.
Red Hat addressed CVE-2014-0050 for Red Hat Enterprise Linux 6 through RHSA-2014:0429.
Red Hat released the Moderate-impact JBoss A-MQ 6.1.0 update for A-MQ 6.0.0, fixing CVE-2014-0050 and eight other security vulnerabilities. The update also addressed flaws in Hadoop RPC, Spring Framework, HawtJNI, and ZooKeeper.
Red Hat addressed CVE-2014-0050 in Red Hat JBoss Fuse 6.1.0 through RHSA-2014:0400.
Red Hat addressed CVE-2014-0050 for JBoss BRMS 6.0.1 and JBoss BPM Suite 6.0.1 through RHSA-2014:0373.
Apache corrected the Apache Commons FileUpload flaw in source commit r1565143 and the related Tomcat 7 issue in commit r1565169. The flaw could cause an infinite loop when processing a crafted multipart Content-Type header.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceseclists.org
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026
Red Hat released updates for Apache Tomcat and JBoss Web Server deployments on RHEL 6 and RHEL 7 to remediate vulnerabilities spanning local privilege escalation, SecurityManager bypass, directory traversal and disclosure, sensitive-data exposure, and denial of service. On RHEL 6, writable Tomcat configuration files could allow the `tomcat` user—or a compromised web application—to gain root-level code execution through service lifecycle actions; older Tomcat code also allowed authenticated malicious applications to bypass SecurityManager isolation and list parent deployment directories. The updates also address a Commons FileUpload flaw, `CVE-2016-3092`, in which crafted multipart boundaries near the 4,096-byte buffer length could severely slow processing or crash affected Tomcat 7 and 8 applications. Later packages fixed username enumeration through Realm timing differences, SecurityManager bypasses, protected system-property exposure, and unauthorized access to global JNDI resources via `ResourceLinkFactory`; affected organizations should deploy the supported Red Hat Tomcat or JBoss Web Server package updates for their platform.
Aug 29, 2026
Apache Tomcat maintainers disclosed and patched **CVE-2024-50379**, a critical remote code execution flaw tied to the default servlet when write access is enabled. The bug is a **TOCTOU race condition** during JSP compilation that can let an unauthenticated attacker upload specially crafted files and execute code on vulnerable servers under specific conditions. The issue affects Tomcat `11.0.x` before `11.0.2`, `10.1.x` before `10.1.34`, and `9.0.x` before `9.0.98`. Advisories also addressed **CVE-2024-54677**, a separate denial-of-service issue in Tomcat sample web applications caused by unrestricted total upload size. Defenders were urged to upgrade immediately to `11.0.2`, `10.1.34`, or `9.0.98`, and to review deployments that expose write-enabled default servlet functionality or retain sample applications in production.
Jul 24, 2026