apache
CVE-2025-48976: Introduce partHeaderTotalSizeMax for all parts of a single request
Flexible limitation policy. Particularly, "partHeaderTotalSizeMax" provides a direct memory usage limits for all parts headers in request level.
partHeaderTotalSizeMax ~~and partHeaderTotalCoutMax~~: apply to all header information for all parts in a single upload file request.
See BZ69710#c31
partHeaderTotalSizeMax looks to be sufficient. No need to limit header count as well.
There are a lot of unrelated changes in this PR. They should be removed.
With the new limit in place the per part header size limit could be relaxed/removed. In 2.0 at least anyway.
partHeaderTotalSizeMaxlooks to be sufficient. No need to limit header count as well.There are a lot of unrelated changes in this PR. They should be removed.
With the new limit in place the per part header size limit could be relaxed/removed. In 2.0 at least anyway.
@markt-asf Unrelated changes removed. Thanks.
I'm confused. https://github.com/advisories/GHSA-vv7r-c36w-3prj says that the CVE is fixed in 2.0.0-M4, while this PR is still open. The OWASP scanner still reports 2.0.0-M4 as affected. Who's right?
This is just an alternative approach. The CVE announcement from the ASF contains the correct version information. The OWASP scanner appears to be reporting a false positive.