You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2025/08/13 12:42:00 UTC
(commons-lang) branch master updated: Document CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-lang.git
The following commit(s) were added to refs/heads/master by this push:
new 4cd563f28 Document CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
4cd563f28 is described below
commit 4cd563f2857169f051f361e44f713cfd3c57a0b8
Author: ggregory <ga...@gmail.com>
AuthorDate: Wed Aug 13 08:41:55 2025 -0400
Document CVE-2025-48924 ClassUtils.getClass(...) can throw a
StackOverflowError on very long inputs
---
src/site/xdoc/security.xml | 72 +++++++++++++++++++++++++++++++++++++++-------
1 file changed, 61 insertions(+), 11 deletions(-)
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index 38445f90d..0d79de1db 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -1,11 +1,9 @@
<?xml version="1.0"?>
-<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under
- the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may
- obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to
- in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
- ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under
- the License. -->
+<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding
+ copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may
+ obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed
+ on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the
+ License. -->
<document>
<properties>
<title>Apache Commons Lang Security Reports</title>
@@ -25,14 +23,66 @@
</p>
<p>
If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send
- your questions to the public
- <a href="mail-lists.html">user mailing list</a>.
+ your questions to the
+ public
+ <a href="mail-lists.html">user mailing list</a>
+ .
</p>
<p>
If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are
- incomplete, please report them privately to the
- <a href="https://commons.apache.org/security.html">Apache Security Team</a>.
+ incomplete, please report
+ them privately to the
+ <a href="https://commons.apache.org/security.html">Apache Security Team</a>
+ .
</p>
+ <section name="CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs">
+ <p>
+ ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs.
+ </p>
+ <p>
+ Affected versions:
+ </p>
+ <ul>
+ <li>Apache Commons Lang (commons-lang:commons-lang) 2.0 through 2.6</li>
+ <li>Apache Commons Lang (org.apache.commons:commons-lang3) 3.0 before 3.18.0</li>
+ </ul>
+ <p>
+ Uncontrolled Recursion vulnerability in Apache Commons Lang.
+ </p>
+ <p>
+ This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
+ </p>
+ <p>
+ The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
+ StackOverflowError could cause an application to stop.
+ </p>
+ <p>
+ Users are recommended to upgrade to version 3.18.0, which fixes the issue.
+ </p>
+ <p>
+ Credit:
+ </p>
+ <p>
+ OSS-Fuzz Issue 42522972 (finder)
+ </p>
+ <p>
+ References:
+ </p>
+ <p>
+ <ul>
+ <li>
+ <a href="https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1">Announcement email</a>
+ </li>
+ <li>
+ <a href="https://www.cve.org/CVERecord?id=CVE-2025-48924">cve.org CVE-2025-48924</a>
+ </li>
+ </ul>
+ </p>
+ <p>
+ </p>
+ <p>
+ </p>
+ </section>
</section>
</body>
</document>
\ No newline at end of file