CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be
CVSS
7.5
Alta
EPSS
37.2%
p99
KEV
—
Exploit Today
30
0-100
Publicado: 4 de jul. de 2016 · Última mod.: 7 de out. de 2026 · CWE-20
37.2%EPSS · 30 dias37.2%
2026-10-112026-11-08
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
- jvn.jphttp://jvn.jp/en/jp/JVN89379547/index.html
- jvndb.jvn.jphttp://jvndb.jvn.jp/jvndb/JVNDB-2016-000121
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
- mail-archives.apache.orghttp://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2068.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2069.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2070.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2071.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2072.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2599.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2807.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2808.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2017-0457.html
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1743480
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1743722
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1743738
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1743742
- tomcat.apache.orghttp://tomcat.apache.org/security-7.html
- tomcat.apache.orghttp://tomcat.apache.org/security-8.html
- tomcat.apache.orghttp://tomcat.apache.org/security-9.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1192744.8 MÉD—
———Stored XSS attacks occur when an attacker injects a malicious script in Global Smart Folders feature in NIOS3hCVE-2026-842283.1 BAI—
——0IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.22hCVE-2026-185254.9 MÉD—
——0IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.23hCVE-2026-1236135.3 MÉD4.7%
——1Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.2dCVE-2026-1235747.5 ALT28.1%
——8The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.2dCVE-2026-1235737.5 ALT28.1%
——8hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.2d