CVE-2025-48924

11.07.2025, 15:15

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting withcommons-lang:commons-lang2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before3.18.0.

The methods ClassUtils.getClass(...) can throwStackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError couldcause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
apache	CNA	---				---
CISA-ADP	ADP	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

libcommons-lang-java

bullseye	vulnerable
trixie	vulnerable
sid	vulnerable
bookworm	vulnerable

libcommons-lang3-java

bullseye	vulnerable
bookworm	vulnerable
trixie	vulnerable
sid	vulnerable

Common Weakness Enumeration

CWE-674 - Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1