CVE-2024-47554: apache software foundation apache commons io Uncontrolled Resource Consumption

CVSS: 4.3v3.1MediumAnalyzed

AliasesSUSE-RU-2025:1150-1SUSE-SU-2024:3596-1UBUNTU-CVE-2024-47554+533 more

Published 03-10-2024Last modified 31-01-2025

Vulnerability summary

CVE-2024-47554 is a medium (CVSS 4.3) Uncontrolled Resource Consumption vulnerability in apache software foundation apache commons io. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.2% of scored vulnerabilities.

Overall risk

17/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.31%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

03-10-2024
PublishedVulnerability first disclosed.
31-01-2025
Last modifiedVulnerability information updated.

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

CVSS metrics

8 scores · 7 sources · 2 versions

v4.08.7v3.14.3

EPSS trend

Probability

1.31%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

0.00 pp

From 1.31% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Chainguard198 products

apache-nifi< 2.0.0-r0
apache-nifi-compat< 2.0.0-r0
apache-nifi-toolkit< 2.0.0-r0
celeborn-0.5< 0.5.4-r26
celeborn-0.6< 0.6.3-r7

confluent-common-docker< 7.6.9-r0
confluent-kafka< 8.0.0.6-r0
confluent-kafka-jre-bcfips< 8.0.0.9-r0
druid< 37.0.0-r56 | All versions (No fix recorded) | < 37.0.0-r0 | < 37.0.0-r14
eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)
eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
eco-java-gradle-6.9All versions (No fix recorded)
eco-java-gradle-6.9.1All versions (No fix recorded)
eco-java-gradle-6.9.2All versions (No fix recorded)
eco-java-gradle-6.9.3All versions (No fix recorded)
eco-java-gradle-6.9.4All versions (No fix recorded)
eco-java-gradle-7.0All versions (No fix recorded)
eco-java-gradle-7.0.1All versions (No fix recorded)
eco-java-gradle-7.0.2All versions (No fix recorded)
eco-java-gradle-7.1All versions (No fix recorded)
eco-java-gradle-7.1.1All versions (No fix recorded)
eco-java-gradle-7.2All versions (No fix recorded)
eco-java-gradle-7.3All versions (No fix recorded)
eco-java-gradle-7.3.1All versions (No fix recorded)
eco-java-gradle-7.3.2All versions (No fix recorded)
eco-java-gradle-7.3.3All versions (No fix recorded)
eco-java-gradle-7.4All versions (No fix recorded)
eco-java-gradle-7.4.1All versions (No fix recorded)
eco-java-gradle-7.4.2All versions (No fix recorded)
eco-java-gradle-7.5All versions (No fix recorded)
eco-java-gradle-7.5.1All versions (No fix recorded)
eco-java-gradle-7.6All versions (No fix recorded)
eco-java-gradle-7.6.1All versions (No fix recorded)
eco-java-gradle-7.6.2All versions (No fix recorded)
eco-java-gradle-7.6.3All versions (No fix recorded)
eco-java-gradle-7.6.4All versions (No fix recorded)
eco-java-gradle-8.0All versions (No fix recorded)
eco-java-gradle-8.0.1All versions (No fix recorded)
eco-java-gradle-8.0.2All versions (No fix recorded)
eco-java-gradle-8.1All versions (No fix recorded)
eco-java-gradle-8.1.1All versions (No fix recorded)
eco-java-gradle-8.2All versions (No fix recorded)
eco-java-gradle-8.2.1All versions (No fix recorded)
eco-java-gradle-8.3All versions (No fix recorded)
eco-java-gradle-8.4All versions (No fix recorded)
eco-java-gradle-8.5All versions (No fix recorded)
eco-java-gradle-8.6All versions (No fix recorded)
eco-java-gradle-8.7All versions (No fix recorded)
gradle-stage0All versions (No fix recorded)
hadoop-client-modules< 3.3.6-r8
hadoop-fips-3.3.6< 3.3.6-r23 | < 3.3.6-r26 | All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)
kafka_exporter-strimzi-compat< 0.45.0-r2
kafka-3.7< 3.7.1-r1
kafka-3.8< 3.8.1-r0
kafka-strimzi-compat< 0.45.0-r2
kserve< 0.14.0-r0
kserve-agent< 0.14.0-r0
kserve-agent-compat< 0.14.0-r0
kserve-manager< 0.14.0-r0
kserve-manager-compat< 0.14.0-r0
kserve-modelmesh< 0.12.0-r13
kserve-modelmesh-compat< 0.12.0-r13
kserve-qpext< 0.14.0-r0
kserve-qpext-compat< 0.14.0-r0
kserve-router< 0.14.0-r0
kserve-router-compat< 0.14.0-r0
kserve-storage-controller< 0.14.0-r0
logstash-8-with-output-opensearch< 8.15.4-r0
management-api-for-apache-cassandra-4.0< 0.1.89-r0
management-api-for-apache-cassandra-4.0-compat< 0.1.89-r0
management-api-for-apache-cassandra-4.1< 0.1.109-r0
management-api-for-apache-cassandra-5.0< 0.1.89-r0
management-api-for-apache-cassandra-5.0-compat< 0.1.89-r0
opensearch-2< 2.17.1-r1
opensearch-2-alerting< 2.17.1-r1
opensearch-2-analysis-icu< 2.17.1-r1
opensearch-2-analysis-kuromoji< 2.17.1-r1
opensearch-2-analysis-nori< 2.17.1-r1
opensearch-2-analysis-phonetic< 2.17.1-r1
opensearch-2-analysis-smartcn< 2.17.1-r1
opensearch-2-analysis-stempel< 2.17.1-r1
opensearch-2-analysis-ukrainian< 2.17.1-r1
opensearch-2-anomaly-detection< 2.17.1-r1
opensearch-2-asynchronous-search< 2.17.1-r1
opensearch-2-cross-cluster-replication< 2.17.1-r1
opensearch-2-crypto-kms< 2.17.1-r1
opensearch-2-custom-codecs< 2.17.1-r1
opensearch-2-discovery-azure-classic< 2.17.1-r1
opensearch-2-discovery-ec2< 2.17.1-r1
opensearch-2-discovery-gce< 2.17.1-r1
opensearch-2-entrypoint-compat< 2.17.1-r1
opensearch-2-geospatial< 2.17.1-r1
opensearch-2-identity-shiro< 2.17.1-r1
opensearch-2-index-management< 2.17.1-r1
opensearch-2-ingest-attachment< 2.17.1-r1
opensearch-2-job-scheduler< 2.17.1-r1
opensearch-2-k-nn< 2.17.1-r1
opensearch-2-mapper-annotated-text< 2.17.1-r1
opensearch-2-mapper-murmur3< 2.17.1-r1
opensearch-2-mapper-size< 2.17.1-r1
opensearch-2-ml-commons< 2.17.1-r1
opensearch-2-neural-search< 2.17.1-r1
opensearch-2-notifications< 2.17.1-r1
opensearch-2-observability< 2.17.1-r1
opensearch-2-performance-analyzer< 2.17.1-r1
opensearch-2-reporting< 2.17.1-r1
opensearch-2-repository-azure< 2.17.1-r1
opensearch-2-repository-gcs< 2.17.1-r1
opensearch-2-repository-s3< 2.17.1-r1
opensearch-2-security< 2.17.1-r1
opensearch-2-security-analytics< 2.17.1-r1
opensearch-2-sql< 2.17.1-r1
opensearch-2-store-smb< 2.17.1-r1
opensearch-2-telemetry-otel< 2.17.1-r1
opensearch-2-transport-nio< 2.17.1-r1
prometheus-jmx-exporter-strimzi-compat< 0.45.0-r2
rangerAll versions (No fix recorded)
sonarqube< 25.6.0.109173-r0
sonarqube-10< 24.12.0.100206-r0
sonarqube-docker-compat< 25.6.0.109173-r0
sonarqube-scripts< 25.6.0.109173-r0
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
strimzi-kafka-operator< 0.45.0-r2

Show all 198

Apache1 product

commons_io≥ 2.0, < 2.14.0

Apache software foundation1 product

apache commons io≥ 2.0, < 2.14.0

3 vendors · 200 products · Showing 200 of 297. Use Open JSON for the complete list.

References

17 links

lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1Vendor AdvisoryREPORTAdvisoryWEBMailing List
www.openwall.com/lists/oss-security/2024/10/03/2WEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20250131-0010/AdvisoryThird Party Advisory
www.suse.com/support/update/announcement/-2025-1150/suse-ru-20251150-1/Advisory
bugzilla.suse.com/1231298REPORT
www.suse.com/security/cve/CVE-2024-47554WEB
www.suse.com/support/update/announcement/2024/suse-su-20243596-1/Advisory
ubuntu.com/security/CVE-2024-47554REPORT
www.cve.org/CVERecord?id=CVE-2024-47554REPORT
ubuntu.com/security/notices/USN-8191-1Advisory

Show all 17 references

security-tracker.debian.org/tracker/CVE-2024-47554Advisory
repo.maven.apache.org/maven2WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47554.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-47554AdvisoryOval
lists.opensuse.org/archives/…Advisory
github.com/apache/commons-ioPACKAGE
security.netapp.com/advisory/ntap-20250131-0010WEB

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities