Uncontrolled Recursion in Apache Commons Lang - CVE-2025-48924

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU113607

Uncontrolled Recursion in Apache Commons Lang - CVE-2025-48924

Published: August 4, 2025 / Updated: April 22, 2026


Vulnerability identifier: #VU113607
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-48924
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. A remote attacker can trigger uncontrolled recursion and perform a denial of service (DoS) attack.


Affected software

Apache Commons Lang
Oracle Application Development Framework (ADF)
IBM App Connect Enterprise
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
Ubuntu
Basesystem Module
Development Tools Module
openSUSE Leap
openEuler
Anolis OS
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Concert Software
IBM Observability with Instana
IBM OmniFind Text Search Server for DB2 for i
IBM Cloud Transformation Advisor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Sterling Partner Engagement Manager
Oracle Communications Network Integrity
Oracle Communications IP Service Activator
Oracle Communications Unified Inventory Management
IBM Maximo Asset Management
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Model Management and Governance
Oracle Healthcare Data Repository
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM Common Licensing
Oracle Communications Diameter Signaling Router
Oracle Communications Session Report Manager
IBM Transformation Extender Advanced
Rational Functional Tester (RFT)
IBM Netezza Analytics for NPS
Hyperion Financial Management
Hyperion Profitability and Cost Management
Infrastructure Technology
Oracle Identity Manager Connector
Oracle Web Services Manager
Oracle Middleware Common Libraries and Tools
Oracle Enterprise Data Quality
Enterprise Manager Base Platform
Oracle WebCenter Forms Recognition
Oracle Banking Trade Finance
IBM SPSS Modeler
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Network Repository Function
Oracle Cloud Native Session Border Controller
IBM Operator for Apache Flink
IBM Sterling Connect:Direct Web Services
IBM SPSS Collaboration and Deployment Services
App Connect Enterprise Certified Container
IBM App Connect for Healthcare
Jazz Reporting Service
IBM Cognos Command Center
Event Streams
Oracle Hyperion Calculation Manager
clickhouse-java
Event Processing
Application Modernization Accelerator Developer Tools (VSCode and Eclipse)
Netezza Appliance
DataPower Operations Dashboard
Operations Analytics - Log Analysis
watsonx Orchestrate Developer Edition
PowerVM NovaLink
DB2 Data Management Console
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Oracle Healthcare Master Person Index
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
DataStage on Cloud Pak for Data
Oracle Hospitality OPERA 5 Property Services
Oracle Communications ASAP
Oracle Business Intelligence Enterprise Edition
Oracle BI Publisher
Oracle Financial Services Analytical Applications Infrastructure
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect Client
Storage Protect Server
Maximo Application Suite - Monitor Component
IBM Engineering Systems Design Rhapsody
Maximo Application Suite Ai Service
Rational Performance Tester
Total Storage Service Console (TSSC) / TS4500 IMC
IBM Engineering Requirements Management DOORS Next
Integration Bus for z/OS
DevOps Test UI
IBM Event Endpoint Management
DevOps Test Performance
ApplinX
Financial Reporting
Oracle Application Testing Suite
Oracle Retail Service Backbone
Oracle Financial Services Lending and Leasing
Oracle Communications Policy Management
Oracle Retail Xstore Point of Service
Business Automation Insights
Storage Insights - Data Collector
Astronomer with IBM
Application Modernization Accelerator
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
IBM Engineering Lifecycle Optimization - Publishing
MongoDB Enterprise Advanced with IBM
Db2 Big SQL
Maximo Application Suite - IoT Component
Guardium Data Protection
IBM Disconnected Log Collector
JD Edwards EnterpriseOne Tools
Primavera Unifier
Voice Gateway
Oracle Communications Convergence
Communications Unified Assurance
Communications Service Catalog and Design
Oracle Communications Calendar Server
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
watsonx.data
IBM Cloud Pak System
Oracle Utilities Application Framework
Oracle Utilities Testing Accelerator
Oracle Financial Services Compliance Studio
Oracle Communications Element Manager
PeopleSoft Enterprise CS Financial Aid
Oracle Insurance Policy Administration
Oracle WebCenter Sites
Oracle Managed File Transfer
Oracle Business Process Management Suite
Oracle SOA Suite
Oracle Banking Virtual Account Management
Oracle Banking Corporate Lending Process Management
Oracle Banking Branch
Oracle Banking Liquidity Management
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Retail Warehouse Management System
Stream Analytics
Oracle Communications Order and Service Management
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Hyperion Planning
Hyperion Financial Close Management
Oracle WebCenter Portal
Oracle Retail Sales Audit
Siebel CRM Deployment
Siebel CRM Integration
Oracle Hospitality Cruise Shipboard Property Management System
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Financial Integration
Oracle Retail Fiscal Management
Oracle Retail Assortment Planning
Oracle Retail Merchandising System
IBM InfoSphere Information Server
Oracle GoldenGate Big Data and Application Adapters
Oracle Database Server
Identity Manager
Oracle WebLogic Server
Primavera Gateway
AMQ Streams
Oracle Access Manager
Oracle Service Bus
Oracle Retail Integration Bus
maven-resolver-named-locks
maven-resolver-connector-basic
maven-resolver-transport-file
maven-resolver-transport-http
maven-resolver-transport-wagon
maven-resolver-api
maven-resolver-impl
maven-resolver-util
maven-resolver-spi
plexus-interpolation
apache-commons-compress
beust-jcommander
jansi-debuginfo
jansi
libcommons-lang-java (Ubuntu package)
apache-commons-lang
apache-commons-lang-help
apache-commons-lang-javadoc
plexus-xml
maven
maven-lib
apache-commons-lang3
apache-commons-lang3-help
apache-commons-lang3-javadoc
xmvn-resolve
xmvn-subst
xmvn-api
xmvn-mojo
xmvn
xmvn-connector
xmvn-minimal
xmvn-core
xmvn-install
google-guice
guava

How to mitigate CVE-2025-48924

Install updates from vendor's website.

Apache Commons Lang - update to 3.18.0
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.39
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
clickhouse-java - update to 0.9.6
Event Processing - update to 1.4.5
Application Modernization Accelerator Developer Tools (VSCode and Eclipse) - update to 1.1
Netezza Appliance - update to 1.0.0.1
IBM Disconnected Log Collector - update to 2.0.0
IBM Concert Software - update to 2.2.0
Voice Gateway - update to 1.0.8.22
DataPower Operations Dashboard - update to 1.0.23.3
IBM Observability with Instana - update to 1.0.304
Operations Analytics - Log Analysis - update to 1.3.8.4
watsonx Orchestrate Developer Edition - update to 1.13.0
PowerVM NovaLink - addressed in versions 2.1.1-251007, 2.2.1.1-251007, 2.3.1-251007
IBM Cloud Transformation Advisor - update to 4.3.2
watsonx.data - update to 2.3.1
IBM Cloud Pak System - update to 2.3.5.1
DB2 Data Management Console - update to 3.1.13.2
Guardium Data Security Center (GDSC) - update to 3.8.5
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.2
DataStage on Cloud Pak for Data - update to 5.2.2
IBM Sterling Secure Proxy - addressed in versions 6.1.0.3, 6.2.0.3, 6.2.1.1
IBM Sterling External Authentication Server - addressed in versions 6.1.0.4, 6.1.1.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
Jazz Reporting Service - addressed in versions 7.0.2 iFix0036, 7.0.3 iFix022, 7.1 iFix009
IBM Maximo Asset Management - update to 7.6.1.3.36
Storage Protect for Space Management - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.2.0
Storage Protect Client - update to 8.2.2.0
Storage Protect Server - update to 8.2.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.7.24, 9.0.17, 9.1.3
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
IBM Common Licensing - update to 9.0.0.2
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.2.0.5, 10.0.0.3, 10.0.1.0.4, 10.0.2.0.2
Maximo Application Suite Ai Service - update to 9.1.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
IBM Transformation Extender Advanced - addressed in versions 10.0.1.11, 10.0.2.1
IBM Cognos Command Center - update to 10.2.5 FP1 IF2
DevOps Test UI - update to 11.0.7
IBM Event Endpoint Management - update to 11.7.0
Event Streams - update to 12.1.0
DevOps Test Performance - update to 11.0.8
IBM Netezza Analytics for NPS - update to 11.2.30
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Stream Analytics - update to 19.1.0.0.12
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
Storage Insights - Data Collector - update to 20251030-0236
Astronomer with IBM - update to 1.1.0
IBM Operator for Apache Flink - update to 1.4.5
maven-resolver-named-locks - update to 1.9.27-150200.3.29.1
maven-resolver-connector-basic - update to 1.9.27-150200.3.29.1
maven-resolver-transport-file - update to 1.9.27-150200.3.29.1
maven-resolver-transport-http - update to 1.9.27-150200.3.29.1
maven-resolver-transport-wagon - update to 1.9.27-150200.3.29.1
maven-resolver-api - update to 1.9.27-150200.3.29.1
maven-resolver-impl - update to 1.9.27-150200.3.29.1
maven-resolver-util - update to 1.9.27-150200.3.29.1
maven-resolver-spi - update to 1.9.27-150200.3.29.1
plexus-interpolation - update to 1.27.0-150200.3.9.1
apache-commons-compress - update to 1.28.0-150200.3.21.1
beust-jcommander - update to 1.83-150200.3.15.1
jansi-debuginfo - update to 2.4.0-150200.3.9.1
jansi - update to 2.4.0-150200.3.9.1
libcommons-lang-java (Ubuntu package) - addressed in versions 2.6-3ubuntu2+esm1, 2.6-6ubuntu2+esm1, 2.6-8ubuntu0.1~esm1, 2.6-9ubuntu0.20.04.1~esm1, 2.6-9ubuntu0.22.04.1, 2.6-10ubuntu0.1, 3.2.1-1ubuntu0.1~esm1, 3.4-1ubuntu0.1~esm1, 3.8-1~18.04.2+esm1, 3.8-2ubuntu0.1~esm1, 3.11-1ubuntu0.1, 3.14.0-1ubuntu0.1~esm1
apache-commons-lang - addressed in versions 2.6-5.3.1, 2.6-150200.14.3.1
apache-commons-lang-help - update to 2.6-24
apache-commons-lang - update to 2.6-24
apache-commons-lang-javadoc - update to 2.6-150200.14.3.1
plexus-xml - update to 3.0.1-150200.5.10.1
AMQ Streams - update to 3.1.0
maven - update to 3.9.16-150200.4.33.1
maven-lib - update to 3.9.16-150200.4.33.1
apache-commons-lang3 - update to 3.18.0-1
apache-commons-lang3 - update to 3.18.0-1
apache-commons-lang3-help - update to 3.18.0-1
apache-commons-lang3 - addressed in versions 3.18.0-150200.3.12.1, 3.20.0-150200.3.15.2
apache-commons-lang3-javadoc - update to 3.18.0-150200.3.12.1
xmvn-resolve - update to 4.3.0-150200.3.30.1
xmvn-subst - update to 4.3.0-150200.3.30.1
xmvn-api - update to 4.3.0-150200.3.30.1
xmvn-mojo - update to 4.3.0-150200.3.30.1
xmvn - update to 4.3.0-150200.3.30.1
xmvn-connector - update to 4.3.0-150200.3.30.1
xmvn-minimal - update to 4.3.0-150200.3.30.1
xmvn-core - update to 4.3.0-150200.3.30.1
xmvn-install - update to 4.3.0-150200.3.30.1
Application Modernization Accelerator - update to 4.3.2
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4
watsonx Assistant Cartridge - update to 5.4
google-guice - update to 6.0.0-150200.3.13.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.14.0.2, 6.4.0.3.0.2
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.36, 7.0.3.19, 7.1.0.5
MongoDB Enterprise Advanced with IBM - update to 8.0.12
Db2 Big SQL - update to 8.2.2
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.5.0.0.27, 8.6.0.0.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.26, 8.8.22, 9.0.12, 9.1.3
Guardium Data Protection - update to 12.0p50
IBM App Connect Enterprise - addressed in versions 12.0.12.20, 13.0.5.2
App Connect Enterprise Certified Container - addressed in versions 12.0.18, 12.18.0
guava - update to 33.2.1-150200.3.15.1

External References

Related Security Bulletins