PT-2025-20548 · Apache+2 · Apache Commons Configuration+2
Arnout Engelen
·
Published
2025-05-09
·
Updated
2026-05-18
·
CVE-2025-46392
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Commons Configuration versions 1.x
Description
The issue is related to Uncontrolled Resource Consumption in Apache Commons Configuration 1.x, which can lead to excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. Users who load untrusted configurations or give attackers control over usage patterns are at risk. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.
Recommendations
For Apache Commons Configuration version 1.x, upgrade to the 2.x version line, which fixes these issues. Note that Apache Commons Configuration 2.x is not a drop-in replacement, but it can be loaded side-by-side with the 1.x version, making it possible to do a gradual migration.
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Commons Configuration
Debian
Red Os