Apache · Apache Commons Io · CVE-2024-47554
**Name of the Vulnerable Software and Affected Versions**
Apache Commons IO versions 2.0 through 2.13.x
**Description**
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO from version 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
**Recommendations**
Upgrade to version 2.14.0 or later, which fixes the issue. As a temporary workaround, consider disabling the `org.apache.commons.io.input.XmlStreamReader` class until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `XmlStreamReader` class in the affected API endpoint until the issue is resolved.