[<prev] [next>] [day] [month] [year] [list]
Message-ID: <c64ede75-0fa8-213b-7f4b-24a7249fbfb2@apache.org>
Date: Fri, 11 Jul 2025 14:25:52 +0000
From: "Gary D. Gregory" <ggregory@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-48924: Apache Commons Lang:
ClassUtils.getClass(...) can throw a StackOverflowError on very long
inputs
Severity: low
Affected versions:
- Apache Commons Lang (commons-lang:commons-lang) 2.0 through 2.6
- Apache Commons Lang (org.apache.commons:commons-lang3) 3.0 before 3.18.0
Description:
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Credit:
OSS-Fuzz Issue 42522972 (finder)
References:
https://commons.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-48924
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
