CVE-2026-45205mediumCWE-674

CVE-2026-45205: falha de média gravidade em Apache Commons Configuration

Apache Commons Configuration: StackOverflowError for YAML input with cycles

Publicada em

Seguir esta CVE+ Monitorar Apache Commons Configuration+ Monitorar commons-configuration2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
Apache Software Foundation · Apache Commons Configuration
CVEs relacionadas — Apache Commons Configuration

No mesmo produto, das mais perigosas para as menos.

CVE-2022-33980—Apache Commons Configuration insecure interpolation defaultsEPSS 44.6%CVE-2025-46392MEDIUMApache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xEPSS 2.1%CVE-2024-29131HIGHApache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()EPSS 2.1%CVE-2024-29133MEDIUMApache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeEPSS 1.7%