Skip to main content

Uncontrolled Recursion in commons-lang:commons-lang

CVE-2025-48924

  • commons-lang:commons-lang
  • org.apache.commons:commons-lang3
Medium
5.3/10

Summary

Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inputs. Because an error is usually not handled by applications and libraries, a `StackOverflowError` could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue. This issue affects commons-lang:commons-lang versions 2.0 through 2.6, and org.apache.commons:commons-lang3 versions 3.0 through 3.17.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-674 - Uncontrolled Recursion

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

Advisory Timeline

  • Published