CVE-2026-45205
Medium · 5.3CVSS
5.3
EPSS
0.8%
Published
May 14, 2026
CISA due date
—
The record
Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | apache-commons-configuration2 | 0 | 2.15.0-1.1 |
Related vulnerabilities
- CVE-2024-29133 Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects… Also affects apache-commons-configuration2
- CVE-2024-29131 Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects… Also affects apache-commons-configuration2
- CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
- CVE-2026-112895 Pillow is a Python imaging library. CWE-674
- CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
- CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
- CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
- CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674