CVE-2025-48924

11.07.2025, 15:15

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting withcommons-lang:commons-lang2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before3.18.0.

The methods ClassUtils.getClass(...) can throwStackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError couldcause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
apache	CNA	---				---
CISA-ADP	ADP	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 53%

Vendor	Product	Version
apache	commons_lang	2.0 ≤ 𝑥 < 2.6
apache	commons_lang	3.0 ≤ 𝑥 < 3.18.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libcommons-lang-java

bullseye	vulnerable
trixie	no-dsa
bookworm	no-dsa
bullseye (security)	2.6-9+deb11u1 fixed
forky	vulnerable
sid	vulnerable

libcommons-lang3-java

bullseye	vulnerable
trixie	no-dsa
bookworm	no-dsa
forky	vulnerable
sid	vulnerable

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1