Your message dated Thu, 22 Oct 2026 12:50:28 +0000
with message-id <[email protected]>
and subject line Bug#1108120: fixed in libcommons-fileupload-java 1.6.0-1
has caused the Debian Bug report #1108120,
regarding libcommons-fileupload-java: CVE-2025-48976
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1108120: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108120
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libcommons-fileupload-java
Version: 1.5-1.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libcommons-fileupload-java.
CVE-2025-48976[0]:
| Allocation of resources for multipart headers with insufficient
| limits enabled a DoS vulnerability in Apache Commons FileUpload.
| This issue affects Apache Commons FileUpload: from 1.0 before 1.6;
| from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to
| versions 1.6 or 2.0.0-M4, which fix the issue.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-48976
https://www.cve.org/CVERecord?id=CVE-2025-48976
[1] https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12
[2]
https://github.com/apache/commons-fileupload/commit/2108495a4775910b8559f18ed5a779d60542ee96
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libcommons-fileupload-java
Source-Version: 1.6.0-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libcommons-fileupload-java, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated
libcommons-fileupload-java package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 12:37:13 +0200
Source: libcommons-fileupload-java
Architecture: source
Version: 1.6.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1108120
Changes:
libcommons-fileupload-java (1.6.0-1) unstable; urgency=medium
.
* New upstream release
- Fixes CVE-2025-48976: allocation of resources for multipart headers
with insufficient limits (Closes: #1108120)
- Refreshed the patches
* Standards-Version updated to 4.7.4
* Removed the Files-Excluded field, no longer needed
* Converted debian/watch to the version 5 format
* Removed the libcommons-fileupload-java-doc package
* Removed the Priority field
* Removed the Rules-Requires-Root field
Checksums-Sha1:
7b481e8f545558a0358492acd1ff1a948e5de9b2 2274
libcommons-fileupload-java_1.6.0-1.dsc
b999ecc1430e42570b684dd081b0faf643609c1a 115692
libcommons-fileupload-java_1.6.0.orig.tar.xz
f20e76b319ef76540ad195f62dc34069012ee009 7380
libcommons-fileupload-java_1.6.0-1.debian.tar.xz
1139fe20c91df8f9603db70c6f3ac86a5c8aebdb 15111
libcommons-fileupload-java_1.6.0-1_source.buildinfo
Checksums-Sha256:
0b06a884537cc91876840c6e4c9b86cd7e0e50497162828e26b85c51fc861303 2274
libcommons-fileupload-java_1.6.0-1.dsc
501cc53fe2cc50ac8524e908e1899afe1b67165c04b84e56103ca1ba7a5f49f5 115692
libcommons-fileupload-java_1.6.0.orig.tar.xz
a57732b18bee21c52487aecec71d4d569eb0b7b79217c4822c5021f34c670121 7380
libcommons-fileupload-java_1.6.0-1.debian.tar.xz
8abcac111d3247a98232ed2dd65f35a89858115c9f40f9792d5665aecba47c9c 15111
libcommons-fileupload-java_1.6.0-1_source.buildinfo
Files:
742f6e41e714fd8ee6456db65f7bbe99 2274 java optional
libcommons-fileupload-java_1.6.0-1.dsc
b0cc61308d3b17f3bcbd433693282fc9 115692 java optional
libcommons-fileupload-java_1.6.0.orig.tar.xz
f7c83ecea6c7900691b2411701f7f4c2 7380 java optional
libcommons-fileupload-java_1.6.0-1.debian.tar.xz
a9eebf382a7931a8ba4e838f1264f93a 15111 java optional
libcommons-fileupload-java_1.6.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmraAfYSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCseDMQAIVwFy39feX3h+t04WD8b9EUytsRSVyW
uuk+fUGqQqxawLK4lW/IJ881z6QXojWQBYTleqbDnOmvfBoKPZoV3iTdCESQoCKZ
JwTXcmh1vim1zkMUQrL1aCmqqDAHxU6ycYoWvJfHrmcMux74bjqK8dp57/2QUyTX
F0i3ECY6KRLDXJkrYIXh4i71r+SzQP3fnTT1xy/wAhwmOgVBKwC6w3SVqXWDqrjJ
9ZEseuWUF5Zh0ueCEZX0zsOOF84xJOZSWAuwwqEg7d8O+WTMOo8kY7NUZstZQuQq
fQtGqg1KUi1inGdjFdiBcy73qedspdqnwXLDejvnT4QHzMQ+9JZNNGvA9jqvym/C
0wJDN3g4d6Z+YGG058AHSAaPDtOahc/PWnEU9Hw9ukw2Kl48sV3m2cvqzO+Qf/3W
IVngz3o6ynIIt25GGyVEkJQ583XNSCOb0zLlaoTKpSaGiJ7MYYJ1v17vhnNcA5We
0iRJSDkUhiohljgjBCuczw0UX+wsq5KceGpdY/DewDD88lV2A1sZl2n7mrA2H4QP
dEL0Jt554aqzF3g+A6WgHGi6Pr8I1tUw7pmtmjDt45Xcd/YugIVsl6v+1ePeGfZx
s5bftR42j8gMERUj5kiIGHt/hWF731S13QrPAIrvXdKcx+5tRcH+CghUHnAAuHZx
bzvruM4dQ+4Z
=bkat
-----END PGP SIGNATURE-----
pgpNtUismvF09.pgp
Description: PGP signature
--- End Message ---
