Improper input validation in Apache Commons Configuration
Priority MEDIUM 52CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Why it matters now
EPSS 0.06323 93rd percentileScored 2026-11-07
Fix Partial org.apache.commons:commons-configuration2 (Maven): 2.7Red Hat: 3 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Configuration | 2.2; 2.3; 2.4; 2.5; 2.6 | — | No fix listed | CNA |
| — | org.apache.commons:commons-configuration2 (Maven) | 2.2 to before 2.7 | 2.7 | Patch available | GHSA-7qx4-pp76-vrqh |
- Apache Commons Configuration VendorApache Affected 2.2; 2.3; 2.4; 2.5; 2.6 Fixed in — No fix listed CNA
- org.apache.commons:commons-configuration2 (Maven) Vendor— Affected 2.2 to before 2.7 Fixed in 2.7 Patch available GHSA-7qx4-pp76-vrqh
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_configuration:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:commons_configuration:2.3:*:*:*:*:*:*:* | 2.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:commons_configuration:2.4:*:*:*:*:*:*:* | 2.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:commons_configuration:2.5:*:*:*:*:*:*:* | 2.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:commons_configuration:2.6:*:*:*:*:*:*:* | 2.6 | Vulnerable | Apache |
| cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:* | 11.2.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:* | 12.1.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* | 19c | Vulnerable | Oracle |
- cpe:2.3:a:apache:commons_configuration:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Apache
- cpe:2.3:a:apache:commons_configuration:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Apache
- cpe:2.3:a:apache:commons_configuration:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Apache
- cpe:2.3:a:apache:commons_configuration:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Apache
- cpe:2.3:a:apache:commons_configuration:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Apache
- cpe:2.3:a:oracle:database_server:11.2.0.4:*:*:*:*:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:12.1.0.2:*:*:*:*:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:database_server:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* | 7.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* | 7.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-7qx4-pp76-vrqh org.apache.commons:commons-configuration2 (Maven) Fixed in 2.7 Advisory →
Red Hat 3 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:3133 Released 2020-07-23 · Red Hat rating ImportantRed Hat AMQ Broker 7.4.4 release and security update
- Red Hat AMQ
- RHSA-2020:2751 Released 2020-06-25 · Red Hat rating ImportantRed Hat AMQ Broker 7.7 release and security update
- Red Hat AMQ
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat AMQ | Fixed | RHSA-2020:2751 |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
Not affected: 16 products
- A-MQ Clients 2
- Red Hat A-MQ Online
- Red Hat BPM Suite 6
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 7
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Application Runtimes
- Red Hat Process Automation 7
- Red Hat Software Collections
- Red Hat Storage 3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1953
- 2026-10-03 Alias added: GHSA-7qx4-pp76-vrqh
References
Advisory 2
Other 7
- [camel-commits] 20200313 [camel] branch camel-3.1.x updated: Update Commons Configuration 2 due to CVE-2020-1953
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269%40%3Ccommits.servicecomb.apache.org%3E
- https://github.com/apache/commons-configuration/commit/add7375cf37fd316d4838c6c56b054fc293b4641
- https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r16a2e949e35780c8974cf66104e812410f3904f752df6b66bf292269@%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0f9a3b7e1d1dd3b64676@%3Ccommits.camel.apache.org%3E
More Apache Commons Configuration vulnerabilities
- TI-2022-14972 Apache Commons Configuration insecure interpolation defaults CVSS 3.1CRITICAL 9.8
- TI-2024-19305 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() CVSS 3.1HIGH 7.3
- TI-2025-29118 Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x CVSS 3.1MEDIUM 6.5
- TI-2026-33022 Apache Commons Configuration: StackOverflowError for YAML input with cycles CVSS 3.1MEDIUM 5.3
- TI-2024-19306 Out-of-bounds write in Apache Commons Configuration CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-1953 · CVE Program
- CVE-2020-1953 · NVD
- FIRST EPSS
- GHSA-7qx4-pp76-vrqh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1953 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences