You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by "Gary D. Gregory" <gg...@apache.org> on 2024/10/03 11:26:22 UTC

CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Severity: low

Affected versions:

- Apache Commons IO 2.0 before 2.14.0

Description:

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.


This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Credit:

CodeQL (tool)

References:

https://commons.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-47554