CVE-2025-48924

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48924
Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:commons_lang:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:commons_lang:*:*:*:*:*:*:*:*
History

28 Jul 2025, 13:45

Type Values Removed Values Added
First Time Apache
Apache commons Lang
References () https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1 - () https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1 - Mailing List, Vendor Advisory
CPE cpe:2.3:a:apache:commons_lang:*:*:*:*:*:*:*:*

14 Jul 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.5 		v2 : unknown
v3 : 5.3
Summary
  • (es) Vulnerabilidad de recursión incontrolada en Apache Commons Lang. Este problema afecta a Apache Commons Lang: a partir de commons-lang:commons-lang 2.0 a 2.6, y desde org.apache.commons:commons-lang3 3.0 hasta 3.18.0. El método ClassUtils.getClass(...) puede generar un error de StackOverflowError en entradas muy largas. Dado que las aplicaciones y librerías no suelen gestionar un error, un error de StackOverflowError podría provocar la detención de una aplicación. Se recomienda actualizar a la versión 3.18.0, que soluciona el problema.

11 Jul 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

11 Jul 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-11 15:15

Updated : 2025-07-28 13:45

NVD link : CVE-2025-48924

Mitre link : CVE-2025-48924

CVE.ORG link : CVE-2025-48924

JSON object : View

Products Affected

apache

  • commons_lang
CWE
CWE-674

Uncontrolled Recursion