Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
Priority LOW 35CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 5 fixed, 38 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02632 85th percentileScored 2026-11-07
Fix Partial Apache Commons Lang (Apache Software Foundation): 3.18.0org.apache.commons:commons-lang3 (Maven): 3.18.0Red Hat: 5 advisoriesRed Hat: 5 fixed, 38 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Lang | 2.0 – 2.6 | — | No fix listed | CNA |
| Apache | Apache Commons Lang | 3.0 to before 3.18.0 | 3.18.0 | Patch available | CNA |
| — | org.apache.commons:commons-lang3 (Maven) | 3.0 to before 3.18.0 | 3.18.0 | Patch available | GHSA-j288-q9x7-2f5v |
| — | commons-lang:commons-lang (Maven) | 2.0 – 2.6 | — | No fix listed | GHSA-j288-q9x7-2f5v |
- Apache Commons Lang VendorApache Affected 2.0 – 2.6 Fixed in — No fix listed CNA
- Apache Commons Lang VendorApache Affected 3.0 to before 3.18.0 Fixed in 3.18.0 Patch available CNA
- org.apache.commons:commons-lang3 (Maven) Vendor— Affected 3.0 to before 3.18.0 Fixed in 3.18.0 Patch available GHSA-j288-q9x7-2f5v
- commons-lang:commons-lang (Maven) Vendor— Affected 2.0 – 2.6 Fixed in — No fix listed GHSA-j288-q9x7-2f5v
Remediation
- Fix · CNA Apache Commons Lang (Apache Software Foundation) Fixed in 3.18.0
- Fix · GHSA-j288-q9x7-2f5v org.apache.commons:commons-lang3 (Maven) Fixed in 3.18.0 Advisory →
Red Hat 5 advisories
- RHSA-2025:23417 Released 2025-12-16 · Red Hat rating ImportantStreams for Apache Kafka 3.1.0 release and security update
- Streams for Apache Kafka 3.1.0
- RHSA-2025:23143 Released 2025-12-11 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.14.2 for Spring Boot release.
- Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
- RHSA-2025:16407 Released 2025-09-22 · Red Hat rating ImportantStreams for Apache Kafka 3.0.1 release and security update
- Streams for Apache Kafka 3.0.1
Show 2 more Red Hat advisories
- RHSA-2025:15697 Released 2025-09-11 · Red Hat rating ImportantStreams for Apache Kafka 2.9.2 release and security update
- Streams for Apache Kafka 2.9.2
- RHSA-2025:12511 Released 2025-08-01 · Red Hat rating ImportantStreams for Apache Kafka 3.0.0 release and security update
- Streams for Apache Kafka 3.0.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 10 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Web Server 5 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Web Server 6 | Affected | No fix yet: Fix deferred |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8 | Fixed | RHSA-2025:23143 |
| Streams for Apache Kafka 2.9.2 | Fixed | RHSA-2025:15697 |
| Streams for Apache Kafka 3.0.0 | Fixed | RHSA-2025:12511 |
| Streams for Apache Kafka 3.0.1 | Fixed | RHSA-2025:16407 |
| Streams for Apache Kafka 3.1.0 | Fixed | RHSA-2025:23417 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48924
- 2026-10-03 Alias added: GHSA-j288-q9x7-2f5v
References
Advisory 2
Other 7
- https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53
- https://github.com/apache/commons-lang
- https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html
- https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html
- https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html
- http://www.openwall.com/lists/oss-security/2025/07/11/1
Sources
- CVE-2025-48924 · CVE Program
- CVE-2025-48924 · NVD
- FIRST EPSS
- GHSA-j288-q9x7-2f5v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-48924 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences