PT-2025-20548 · Apache+2 · Apache Commons Configuration+2

Arnout Engelen · Publicado 2025-05-09 · Atualizado 2026-05-18 · CVE-2025-46392

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Commons Configuration versions 1.x

Description The issue is related to Uncontrolled Resource Consumption in Apache Commons Configuration 1.x, which can lead to excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. Users who load untrusted configurations or give attackers control over usage patterns are at risk. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Apache Commons Configuration version 1.x, upgrade to the 2.x version line, which fixes these issues. Note that Apache Commons Configuration 2.x is not a drop-in replacement, but it can be loaded side-by-side with the 1.x version, making it possible to do a gradual migration.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2025-15579

CLEANSTART-2026-DD05788

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CLEANSTART-2026-VH41554

CVE-2025-46392

GHSA-PVP8-3XJ6-8C6X

Produtos afetados

Apache Commons Configuration

Debian

Red Os

Referências · 258

• https://github.com/apache/commons-configuration · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DD05788.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RN56220.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VH41554.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LE11246.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KU61465.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-52428 · Nota
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://osv.dev/vulnerability/ghsa-xq3w-v528-46rv · Nota
• https://osv.dev/vulnerability/ghsa-493p-pfq6-5258 · Nota
• https://osv.dev/vulnerability/CVE-2026-42585 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-12798 · Nota