CVE-2025-48976

[b2bidev]

Hello

Our scans are reporting security vulnerability (CVE-2025-48976 ) in a commons-fileupload2-core-2.0.0-M1.jar which is part of smartclient.
Could you please share if smartclient is vulnerable ?

Thanks

[Isomorphic]

That's a DOS - an attacker can put together an upload that causes the server to allocate lots of memory without the attacker having to send very much data.

You are only vulnerable if you allow multipart file uploads from untrusted users.

If that's a concern, the fixed library is backwards compatible.

[b2bidev]

Thanks for sharing.