CVE-2016-3092High· 7.5▾ Twilight

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 41.3 · likelihood 7.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 4, 2016

Updated

Oct 7, 2026

CVSS

7.5

Vendor

Product

icewall_identity_manager

CWE

CWE-20

Depth score

48 · Moderate

EPSS

36% · p98

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2025-06-04

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 3747 days

Jul 4, 2016Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
36%

hp CWE-20 #nvd #cve.org

Affected

icewall_identity_manager = 5.0
icewall_sso_agent_option = 10.0
tomcat = 9.0.0
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat = 8.0.5
tomcat = 8.0.8
tomcat = 8.0.11
tomcat = 8.0.12
tomcat = 8.0.14
tomcat = 8.0.15
tomcat = 8.0.17
tomcat = 8.0.18
tomcat = 8.0.20
tomcat = 8.0.21
tomcat = 8.0.22
tomcat = 8.0.23
tomcat = 8.0.24
tomcat = 8.0.26
tomcat = 8.0.27
tomcat = 8.0.28
tomcat = 8.0.29
tomcat = 8.0.30
tomcat = 8.0.32
tomcat = 8.0.33
tomcat = 8.0.35
debian_linux = 8.0
tomcat = 8.5.0
tomcat = 8.5.2
commons_fileupload <= 1.3.1
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 15.10
ubuntu_linux = 16.04
tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.8
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.14
tomcat = 7.0.16
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.37
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.47
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 7.0.53
tomcat = 7.0.54
tomcat = 7.0.55
tomcat = 7.0.56
tomcat = 7.0.57
tomcat = 7.0.59
tomcat = 7.0.61
tomcat = 7.0.62
tomcat = 7.0.63
tomcat = 7.0.64
tomcat = 7.0.65
tomcat = 7.0.67
tomcat = 7.0.68
tomcat = 7.0.69

Full technical detail▾

Overview

Affected

icewall_identity_manager = 5.0
icewall_sso_agent_option = 10.0
tomcat = 9.0.0
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat = 8.0.5
tomcat = 8.0.8
tomcat = 8.0.11
tomcat = 8.0.12
tomcat = 8.0.14
tomcat = 8.0.15
tomcat = 8.0.17
tomcat = 8.0.18
tomcat = 8.0.20
tomcat = 8.0.21
tomcat = 8.0.22
tomcat = 8.0.23
tomcat = 8.0.24
tomcat = 8.0.26
tomcat = 8.0.27
tomcat = 8.0.28
tomcat = 8.0.29
tomcat = 8.0.30
tomcat = 8.0.32
tomcat = 8.0.33
tomcat = 8.0.35
debian_linux = 8.0
tomcat = 8.5.0
tomcat = 8.5.2
commons_fileupload <= 1.3.1
ubuntu_linux = 12.04
ubuntu_linux = 14.04
ubuntu_linux = 15.10
ubuntu_linux = 16.04
tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.8
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.14
tomcat = 7.0.16
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.37
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.47
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 7.0.53
tomcat = 7.0.54
tomcat = 7.0.55
tomcat = 7.0.56
tomcat = 7.0.57
tomcat = 7.0.59
tomcat = 7.0.61
tomcat = 7.0.62
tomcat = 7.0.63
tomcat = 7.0.64
tomcat = 7.0.65
tomcat = 7.0.67
tomcat = 7.0.68
tomcat = 7.0.69

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org