CVE-2025-48976

Bug Fixes

Apache Commons FileUpload provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A specially crafted request that used a large number of parts with large headers could trigger excessive memory usage leading to a DoS. This limit is now configurable (maxPartHeaderSize on the Connector) with a default of 512 bytes.

New Configuration Options:
Tomcat now supports two new attributes on the <Connector> element to mitigate excessive memory usage from multipart requests:
maxPartCount: Maximum number of parts allowed in a multipart/form-data request. Default: 50.
maxPartHeaderSize: Maximum header size (in bytes) allowed per part. Default: 512.

Example Configuration:
Add the following to your server.xml Connector configuration:

<Connector port="8080"
protocol="HTTP/1.1"
maxPartCount="20"
maxPartHeaderSize="1024"
 ... />
This example limits requests to 20 parts, with each part's headers limited to 1024 bytes.

Expected Error When Limits Are Exceeded:

If a request exceeds either limit, Tomcat will reject the request and respond with:

HTTP Status 500 – Internal Server Error

Org.apache.tomcat.util.http.fileupload.impl.FileCountLimitExceededException: attachment

or

HTTP Status 500 – Internal Server Error

org.apache.tomcat.util.http.fileupload.impl.FileUploadBase$FileUploadIOException: org.apache.tomcat.util.http.fileupload.impl.PartHeaderLimitExceededException: attachment

The error message will indicate whether the part count or header size limit was violated.