CVE-2025-46392: fallo de gravedad media en Apache Commons Configuration
Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 2.1%
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Apache Software Foundation · Apache Commons ConfigurationCVEs relacionadas — Apache Commons Configuration
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-33980—Apache Commons Configuration insecure interpolation defaultsEPSS 44.6%CVE-2024-29131HIGHApache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()EPSS 2.1%CVE-2024-29133MEDIUMApache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeEPSS 1.7%CVE-2026-45205MEDIUMApache Commons Configuration: StackOverflowError for YAML input with cyclesEPSS 0.5%