Hi,

The following vulnerability was published for libcommons-fileupload-java.

CVE-2025-48976[0]:
| Allocation of resources for multipart headers with insufficient
| limits enabled a DoS vulnerability in Apache Commons FileUpload.
| This issue affects Apache Commons FileUpload: from 1.0 before 1.6;
| from 2.0.0-M1 before 2.0.0-M4.  Users are recommended to upgrade to
| versions 1.6 or 2.0.0-M4, which fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-48976
https://www.cve.org/CVERecord?id=CVE-2025-48976
[1] https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12
[2] https://github.com/apache/commons-fileupload/commit/2108495a4775910b8559f18ed5a779d60542ee96

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libcommons-fileupload-java, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1108120@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated libcommons-fileupload-java package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 12:37:13 +0200
Source: libcommons-fileupload-java
Architecture: source
Version: 1.6.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1108120
Changes:
 libcommons-fileupload-java (1.6.0-1) unstable; urgency=medium
 .
   * New upstream release
     - Fixes CVE-2025-48976: allocation of resources for multipart headers
       with insufficient limits (Closes: #1108120)
     - Refreshed the patches
   * Standards-Version updated to 4.7.4
   * Removed the Files-Excluded field, no longer needed
   * Converted debian/watch to the version 5 format
   * Removed the libcommons-fileupload-java-doc package
   * Removed the Priority field
   * Removed the Rules-Requires-Root field
Checksums-Sha1:
 7b481e8f545558a0358492acd1ff1a948e5de9b2 2274 libcommons-fileupload-java_1.6.0-1.dsc
 b999ecc1430e42570b684dd081b0faf643609c1a 115692 libcommons-fileupload-java_1.6.0.orig.tar.xz
 f20e76b319ef76540ad195f62dc34069012ee009 7380 libcommons-fileupload-java_1.6.0-1.debian.tar.xz
 1139fe20c91df8f9603db70c6f3ac86a5c8aebdb 15111 libcommons-fileupload-java_1.6.0-1_source.buildinfo
Checksums-Sha256:
 0b06a884537cc91876840c6e4c9b86cd7e0e50497162828e26b85c51fc861303 2274 libcommons-fileupload-java_1.6.0-1.dsc
 501cc53fe2cc50ac8524e908e1899afe1b67165c04b84e56103ca1ba7a5f49f5 115692 libcommons-fileupload-java_1.6.0.orig.tar.xz
 a57732b18bee21c52487aecec71d4d569eb0b7b79217c4822c5021f34c670121 7380 libcommons-fileupload-java_1.6.0-1.debian.tar.xz
 8abcac111d3247a98232ed2dd65f35a89858115c9f40f9792d5665aecba47c9c 15111 libcommons-fileupload-java_1.6.0-1_source.buildinfo
Files:
 742f6e41e714fd8ee6456db65f7bbe99 2274 java optional libcommons-fileupload-java_1.6.0-1.dsc
 b0cc61308d3b17f3bcbd433693282fc9 115692 java optional libcommons-fileupload-java_1.6.0.orig.tar.xz
 f7c83ecea6c7900691b2411701f7f4c2 7380 java optional libcommons-fileupload-java_1.6.0-1.debian.tar.xz
 a9eebf382a7931a8ba4e838f1264f93a 15111 java optional libcommons-fileupload-java_1.6.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmraAfYSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCseDMQAIVwFy39feX3h+t04WD8b9EUytsRSVyW
uuk+fUGqQqxawLK4lW/IJ881z6QXojWQBYTleqbDnOmvfBoKPZoV3iTdCESQoCKZ
JwTXcmh1vim1zkMUQrL1aCmqqDAHxU6ycYoWvJfHrmcMux74bjqK8dp57/2QUyTX
F0i3ECY6KRLDXJkrYIXh4i71r+SzQP3fnTT1xy/wAhwmOgVBKwC6w3SVqXWDqrjJ
9ZEseuWUF5Zh0ueCEZX0zsOOF84xJOZSWAuwwqEg7d8O+WTMOo8kY7NUZstZQuQq
fQtGqg1KUi1inGdjFdiBcy73qedspdqnwXLDejvnT4QHzMQ+9JZNNGvA9jqvym/C
0wJDN3g4d6Z+YGG058AHSAaPDtOahc/PWnEU9Hw9ukw2Kl48sV3m2cvqzO+Qf/3W
IVngz3o6ynIIt25GGyVEkJQ583XNSCOb0zLlaoTKpSaGiJ7MYYJ1v17vhnNcA5We
0iRJSDkUhiohljgjBCuczw0UX+wsq5KceGpdY/DewDD88lV2A1sZl2n7mrA2H4QP
dEL0Jt554aqzF3g+A6WgHGi6Pr8I1tUw7pmtmjDt45Xcd/YugIVsl6v+1ePeGfZx
s5bftR42j8gMERUj5kiIGHt/hWF731S13QrPAIrvXdKcx+5tRcH+CghUHnAAuHZx
bzvruM4dQ+4Z
=bkat
-----END PGP SIGNATURE-----