Skip to main content

Uncontrolled Recursion in commons-collections:commons-collections

Cx78f40514-81ff

  • commons-collections:commons-collections
  • org.apache.commons:commons-collections4
High
7.5/10

Summary

The framework Apache Commons Collections before 4.3 is vulnerable to Stack Overflow. The function `add()` in the file `list/SetUniqueList.java` throws a StackOverflowError when the `add()` method is called with its own list. Please note: the package name was changed from "commons-collections:commons-collections" to "org.apache.commons:commons-collections4" on version 4.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-674 - Uncontrolled Recursion

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

References

Advisory Timeline

  • Published