diff --git a/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java b/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
index 10e7a0954..b7c756ca7 100644
--- a/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
+++ b/src/main/java/org/apache/commons/fileupload/RFC2231Utility.java
@@ -139,7 +139,8 @@ private static byte[] fromHex(final String text) {
             final char c = text.charAt(i++);
             if (c == PERCENT) {
                 if (i > text.length() - 2) {
-                    break; // unterminated sequence
+                    // A '%' that is not followed by two hex digits is a truncated escape sequence.
+                    throw new IllegalArgumentException();
                 }
                 final char c1 = text.charAt(i++);
                 final char c2 = text.charAt(i++);
diff --git a/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java b/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
index 7733dd850..2645d5738 100644
--- a/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
+++ b/src/test/java/org/apache/commons/fileupload/RFC2231UtilityTestCase.java
@@ -75,6 +75,13 @@ void testDecodeNonTokenCharacters() throws Exception {
     }
 
 
+    @Test
+    void testDecodeTruncatedPercentEncoded() throws Exception {
+        assertThrows(IllegalArgumentException.class, () -> RFC2231Utility.decodeText("ISO-8859-1''hello%"));
+        assertThrows(IllegalArgumentException.class, () -> RFC2231Utility.decodeText("ISO-8859-1''hello%3"));
+    }
+
+
     @Test
     void testDecodeUTF8Characters() throws Exception {
         assertThrows(IllegalArgumentException.class, () -> RFC2231Utility.decodeText("UTF-8''\\u8a2e"));