CVEFinder.io

CVE-2025-46392

🔶 medium
🔍 Scan for this CVE
Summary

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurat

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.

There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.


Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

CVSS Score
6.5
Medium
EPSS Score
0.4
Exploit Probability
Published Date
2025-05-09
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.6% of all 338,292 vulnerabilities in our database.

#177,181
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 13, 2025
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2025-07-16
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-400

📦 Affected Products 1

Vendor Product Status Affected Versions
apache commons_configuration Affected
≥ 1.0 < 2.0

🔗 References 3

https://lists.apache.org/thread/y1pl0mn3opz6kwkm873z...
Mailing List Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-29131
Not Applicable
https://www.cve.org/CVERecord?id=CVE-2024-29133
Not Applicable

🔗 Related CVEs 5

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-45205 🔶 medium 5.3 0.1 Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Config... 2026-05-14
CVE-2024-29131 ⚠️ high 7.3 0.2 Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from ... 2024-03-21
CVE-2024-29133 🔶 medium 5.4 0.7 Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from ... 2024-03-21
CVE-2022-33980 ⛔ critical 9.8 86.7 Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expand... 2022-07-06
CVE-2020-1953 ⛔ critical 10.0 2.7 Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of... 2020-03-13
These CVEs affect the same products