CVE-2025-48924: apache software foundation apache commons lang Uncontrolled Recursion

CVSS: 5.3v3.1MediumModified

AliasesMGASA-2025-0293SUSE-SU-2025:02785-1SUSE-SU-2025:02786-1+979 more

Published 11-07-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-48924 is a medium (CVSS 5.3) Uncontrolled Recursion vulnerability in apache software foundation apache commons lang. EPSS estimates a 2.63% chance of exploitation in the next 30 days, higher than 85.2% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

2.63%

0%100%

Low · +0.36 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

11-07-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

2.63%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

+0.36 pp

From 2.27% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Chainguard198 products

airflow-2-bitnami-compatAll versions (No fix recorded)
airflow-3< 3.2.0-r0
airflow-3-bitnami-compatAll versions (No fix recorded)
akhq< 0.26.0-r0
apache-activemq-artemis< 2.42.0-r1

apache-activemq-artemis-compat< 2.42.0-r1
apache-hop< 2.17.0-r7 | < 2.17.0-r0 | < 2.16.0-r0
apache-hop-fips< 2.16.0-r0 | < 2.17.0-r0 | < 2.17.0-r7
apache-nifi< 2.7.1-r0
apache-nifi-registry< 2.4.0-r4
apache-nifi-registry-toolkit< 2.4.0-r4
apache-polarisAll versions (No fix recorded)
apache-polaris-fipsAll versions (No fix recorded)
apache-tika-2.9< 2.9.4-r1
apache-tika-2.9-compat< 2.9.4-r1
apache-tika-3.0< 3.0.0-r14
apache-tika-3.0-compat< 3.0.0-r14
apache-tika-3.1< 3.1.0-r5
apache-tika-3.1-compat< 3.1.0-r5
apache-tika-3.2< 3.2.1-r1
apache-tika-3.2-compat< 3.2.1-r1
apicurio-registry< 3.0.9-r5
apicurio-registry-nginx-config< 3.0.9-r5
apicurio-registry-ui< 3.0.9-r5
automq< 1.7.4-r1 | All versions (No fix recorded)
automq-fipsAll versions (No fix recorded) | < 1.7.4-r1
camunda-zeebe-8.6< 8.6.21-r1
camunda-zeebe-8.6-compat< 8.6.21-r1
camunda-zeebe-8.7< 8.7.7-r1
camunda-zeebe-8.7-compat< 8.7.7-r1
cassandra-4.0< 4.0.18-r2
cassandra-4.0-compat< 4.0.18-r2
cassandra-4.0-iamguarded-compat< 4.0.18-r2
cassandra-4.1< 4.1.9-r2
cassandra-4.1-compat< 4.1.9-r2
cassandra-4.1-iamguarded-compat< 4.1.9-r2
cassandra-5.0< 5.0.4-r1
cassandra-5.0-compat< 5.0.4-r1
cassandra-5.0-entrypoint-compat< 5.0.4-r1
cassandra-5.0-iamguarded-compat< 5.0.4-r1
cassandra-fips-4.0< 4.0.15-r3
cassandra-fips-4.0-compat< 4.0.15-r3
cassandra-fips-4.1< 4.1.7-r3
cassandra-fips-4.1-compat< 4.1.7-r3
cassandra-fips-5.0< 5.0.3-r6
cassandra-fips-5.0-compat< 5.0.3-r6
cassandra-reaper< 3.8.0-r7
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r26
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r7
celeborn-0.7< 0.7.0-r11
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.18All versions (No fix recorded)
commercial-elasticsearch-8.19All versions (No fix recorded) | < 8.19.17-r0
commercial-elasticsearch-9.0All versions (No fix recorded)
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded) | < 9.3.6-r0
commercial-elasticsearch-9.4< 9.4.3-r0 | All versions (No fix recorded)
commercial-elasticsearch-9.5All versions (No fix recorded)
confluent-kafka< 8.2.0.25-r0
confluent-kafka-jre-bcfips< 8.2.0.41-r0
cqlsh-5.0< 5.0.4-r1
cqlsh-fips-5.0< 5.0.3-r6
datahub-frontendAll versions (No fix recorded)
debezium-connector-spanner-3.5< 3.5.1-r1
dependency-track< 4.13.2-r2
dependency-track-bundled< 4.13.2-r2
druid< 37.0.0-r56 | < 37.0.0-r14 | All versions (No fix recorded)
eco-java-gradle-1.11All versions (No fix recorded)
eco-java-gradle-2.0All versions (No fix recorded)
eco-java-gradle-2.1All versions (No fix recorded)
eco-java-gradle-2.10All versions (No fix recorded)
eco-java-gradle-2.11All versions (No fix recorded)
eco-java-gradle-2.12All versions (No fix recorded)
eco-java-gradle-2.13All versions (No fix recorded)
eco-java-gradle-2.14All versions (No fix recorded)
eco-java-gradle-2.14.1All versions (No fix recorded)
eco-java-gradle-2.2All versions (No fix recorded)
eco-java-gradle-2.2.1All versions (No fix recorded)
eco-java-gradle-2.3All versions (No fix recorded)
eco-java-gradle-2.4All versions (No fix recorded)
eco-java-gradle-2.5All versions (No fix recorded)
eco-java-gradle-2.6All versions (No fix recorded)
eco-java-gradle-2.7All versions (No fix recorded)
eco-java-gradle-2.8All versions (No fix recorded)
eco-java-gradle-2.9All versions (No fix recorded)
eco-java-gradle-3.0All versions (No fix recorded)
eco-java-gradle-3.1All versions (No fix recorded)
eco-java-gradle-3.2All versions (No fix recorded)
eco-java-gradle-3.2.1All versions (No fix recorded)
eco-java-gradle-3.3All versions (No fix recorded)
eco-java-gradle-3.4All versions (No fix recorded)
eco-java-gradle-3.4.1All versions (No fix recorded)
eco-java-gradle-3.5All versions (No fix recorded)
eco-java-gradle-3.5.1All versions (No fix recorded)
eco-java-gradle-4.0All versions (No fix recorded)
eco-java-gradle-4.0.1All versions (No fix recorded)
eco-java-gradle-4.0.2All versions (No fix recorded)
eco-java-gradle-4.1All versions (No fix recorded)
eco-java-gradle-4.10All versions (No fix recorded)
eco-java-gradle-4.10.1All versions (No fix recorded)
eco-java-gradle-4.10.2All versions (No fix recorded)
eco-java-gradle-4.10.3All versions (No fix recorded)
eco-java-gradle-4.2All versions (No fix recorded)
eco-java-gradle-4.2.1All versions (No fix recorded)
eco-java-gradle-4.3All versions (No fix recorded)
eco-java-gradle-4.3.1All versions (No fix recorded)
eco-java-gradle-4.4All versions (No fix recorded)
eco-java-gradle-4.4.1All versions (No fix recorded)
eco-java-gradle-4.5All versions (No fix recorded)
eco-java-gradle-4.5.1All versions (No fix recorded)
eco-java-gradle-4.6All versions (No fix recorded)
eco-java-gradle-4.7All versions (No fix recorded)
eco-java-gradle-4.8All versions (No fix recorded)
eco-java-gradle-4.8.1All versions (No fix recorded)
eco-java-gradle-4.9All versions (No fix recorded)
eco-java-gradle-5.0All versions (No fix recorded)
eco-java-gradle-5.1All versions (No fix recorded)
eco-java-gradle-5.1.1All versions (No fix recorded)
eco-java-gradle-5.2All versions (No fix recorded)
eco-java-gradle-5.2.1All versions (No fix recorded)
eco-java-gradle-5.3All versions (No fix recorded)
eco-java-gradle-5.3.1All versions (No fix recorded)
eco-java-gradle-5.4All versions (No fix recorded)
eco-java-gradle-5.4.1All versions (No fix recorded)
eco-java-gradle-5.5All versions (No fix recorded)
eco-java-gradle-5.5.1All versions (No fix recorded)
eco-java-gradle-5.6All versions (No fix recorded)
eco-java-gradle-5.6.1All versions (No fix recorded)
eco-java-gradle-5.6.2All versions (No fix recorded)
eco-java-gradle-5.6.3All versions (No fix recorded)
eco-java-gradle-5.6.4All versions (No fix recorded)
eco-java-gradle-6.0All versions (No fix recorded)
eco-java-gradle-6.0.1All versions (No fix recorded)
eco-java-gradle-6.1All versions (No fix recorded)
eco-java-gradle-6.1.1All versions (No fix recorded)
eco-java-gradle-6.2All versions (No fix recorded)
eco-java-gradle-6.2.1All versions (No fix recorded)
eco-java-gradle-6.2.2All versions (No fix recorded)
eco-java-gradle-6.3All versions (No fix recorded)
eco-java-gradle-6.4All versions (No fix recorded)
eco-java-gradle-6.4.1All versions (No fix recorded)
eco-java-gradle-6.5All versions (No fix recorded)
eco-java-gradle-6.5.1All versions (No fix recorded)
eco-java-gradle-6.6All versions (No fix recorded)
eco-java-gradle-6.6.1All versions (No fix recorded)
eco-java-gradle-6.7All versions (No fix recorded)
eco-java-gradle-6.7.1All versions (No fix recorded)
eco-java-gradle-6.8All versions (No fix recorded)
eco-java-gradle-6.8.1All versions (No fix recorded)
eco-java-gradle-6.8.2All versions (No fix recorded)
eco-java-gradle-6.8.3All versions (No fix recorded)
eco-java-gradle-6.9All versions (No fix recorded)
eco-java-gradle-6.9.1All versions (No fix recorded)
eco-java-gradle-6.9.2All versions (No fix recorded)
eco-java-gradle-6.9.3All versions (No fix recorded)
eco-java-gradle-6.9.4All versions (No fix recorded)
eco-java-gradle-7.0All versions (No fix recorded)
eco-java-gradle-7.0.1All versions (No fix recorded)
eco-java-gradle-7.0.2All versions (No fix recorded)
eco-java-gradle-7.1All versions (No fix recorded)
eco-java-gradle-7.1.1All versions (No fix recorded)
eco-java-gradle-7.2All versions (No fix recorded)
eco-java-gradle-7.3All versions (No fix recorded)
eco-java-gradle-7.3.1All versions (No fix recorded)
eco-java-gradle-7.3.2All versions (No fix recorded)
eco-java-gradle-7.3.3All versions (No fix recorded)
eco-java-gradle-7.4All versions (No fix recorded)
eco-java-gradle-7.4.1All versions (No fix recorded)
eco-java-gradle-7.4.2All versions (No fix recorded)
eco-java-gradle-7.5All versions (No fix recorded)
eco-java-gradle-7.5.1All versions (No fix recorded)
eco-java-gradle-7.6All versions (No fix recorded)
eco-java-gradle-7.6.1All versions (No fix recorded)
eco-java-gradle-7.6.2All versions (No fix recorded)
eco-java-gradle-7.6.3All versions (No fix recorded)
eco-java-gradle-7.6.4All versions (No fix recorded)
eco-java-gradle-7.6.5All versions (No fix recorded)
eco-java-gradle-7.6.6All versions (No fix recorded)
eco-java-gradle-8.0All versions (No fix recorded)
eco-java-gradle-8.0.1All versions (No fix recorded)
eco-java-gradle-8.0.2All versions (No fix recorded)
eco-java-gradle-8.1All versions (No fix recorded)
eco-java-gradle-8.10All versions (No fix recorded)
eco-java-gradle-8.10.1All versions (No fix recorded)
eco-java-gradle-8.10.2All versions (No fix recorded)
eco-java-gradle-8.1.1All versions (No fix recorded)
eco-java-gradle-8.11.1All versions (No fix recorded)
eco-java-gradle-8.12All versions (No fix recorded)
eco-java-gradle-8.12.1All versions (No fix recorded)
eco-java-gradle-8.13All versions (No fix recorded)
eco-java-gradle-8.14All versions (No fix recorded)
eco-java-gradle-8.14.1All versions (No fix recorded)
eco-java-gradle-8.14.2All versions (No fix recorded)
eco-java-gradle-8.14.3All versions (No fix recorded)
eco-java-gradle-8.14.4All versions (No fix recorded)
eco-java-gradle-8.14.5All versions (No fix recorded)
eco-java-gradle-8.2All versions (No fix recorded)

Show all 198

Apache1 product

commons_lang≥ 2.0, < 2.6 | ≥ 3.0, < 3.18.0

Apache software foundation1 product

apache commons lang≥ 2.0, ≤ 2.6 | ≥ 3.0, < 3.18.0

3 vendors · 200 products · Showing 200 of 609. Use Open JSON for the complete list.

References

25 links

Show all 25 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities