CVE-2026-45205

Published: May 14, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.

Affected (1)

Products: Apache: Commons Configuration

1 product

Commons Configuration

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Commons Configuration	From 2.2 to 2.15.0

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (3)

https://github.com/apache/commons-configuration/pull/634

Source: security@apache.org

Issue TrackingPatch

https://lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/14/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.