[GHSA-j288-q9x7-2f5v] Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs #6407
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
changed the base branch from
main
to
lukaseder/advisory-improvement-6407
|
Thanks for your contribution to the Advisory Database! We are not accepting this contribution as this advisory is about a valid vulnerability, as reaffirmed by the Apache Foundation's assignment and publication of CVE-2025-48924. If you wish to dispute the validity of the CVE, please reach out to the assigning CNA directly. If you wish to dispute the severity, please reach out to the CISA Authorized Data Publisher by filing an issue. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates
Comments
I really think this is just a bug, not a "real" security issue. Anything that parses stuff can run into
StackOverflowErrorif input is too big, and the input passed to this particular method is really not user input or any other "risky" input, but from program internals, so it's very unlikely for this error to appear.I really wish these CVEs were vetted a bit more before they generate tons of alerts everywhere.