GHSA-j288-q9x7-2f5v
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
Quick fix
GHSA-j288-q9x7-2f5v — org.apache.commons:commons-lang3: upgrade to the fixed version with the command below.
# pom.xml: bump <version>3.18.0</version> for org.apache.commons:commons-lang3Details
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
3.0Fixed in: 3.18.0# pom.xml: bump <version>3.18.0</version> for org.apache.commons:commons-lang32.0No fixed version published yet for commons-lang:commons-lang (maven). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-48924[ADVISORY]
- https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53[WEB]
- https://github.com/apache/commons-lang[PACKAGE]
- https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1[WEB]
- https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html[WEB]
- https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html[WEB]
- https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html[WEB]
- https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html[WEB]
- http://www.openwall.com/lists/oss-security/2025/07/11/1[WEB]