CVE-2025-48924

Overview

Apache Commons Lang is a popular open-source Java library that provides a host of utility classes and helper methods for the core classes in Java's java.lang API, which are fundamental to the Java programming language. It simplifies common, recurring programming tasks, making Java code cleaner, more readable, and easier to maintain.

‍

A Denial of Service (DoS) vulnerability (CVE-2025-48924) has been identified in Apache Commons Lang. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because this Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

‍

According to OWASP, a Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives specially crafted input that exploits resource consumption flaws, it may cease to be available to legitimate users.

‍

This issue affects multiple versions of Apache Commons Lang.

‍

Details

Module Info

• Product: Apache Commons Lang
• Affected packages:
  • commons-lang:commons-lang (for 2.x versions)
  • org.apache.commons:commons-lang3 (for 3.x versions)
• Affected versions: >= 2.0 <= 2.6, >= 3.0, < 3.18.0
• GitHub repository: https://github.com/apache/commons-lang
• Published packages:
  • https://central.sonatype.com/artifact/commons-lang/commons-lang
  • https://central.sonatype.com/artifact/org.apache.commons/commons-lang3
• Package manager: Maven
• Fixed in: NES for Apache Commons Lang 3.12.1

‍

Vulnerability Info

The security flaw exists in one of the getClass functions of the ClassUtilities class within Apache Commons Lang which uses recursion to process class names. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs because of Uncontrolled Recursion. Because this Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

‍

Mitigation

Only recent versions of Apache Commons Lang are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected versions to supported versions of Apache Commons Lang
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• OSS-Fuzz Issue 42522972

‍