CVE-2025-48924: Apache Commons Lang Uncontrolled Recursion Vulnerability
Summary
CVE-2025-48924: Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs. Affects org.apache.commons:commons-lang3 versions >= 3.0, < 3.18.0. Fixed in 3.18.0. How to fix ↓
Also tracked for
- libcommons-lang-java · Debian:11
The same CVE-2025-48924 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Lang is a widely used library in Java that provides utility functions for the Java programming language. It offers a range of features such as string manipulation, number handling, and reflection utilities, which enhance the capabilities of Java applications. However, certain versions of this library are susceptible to an uncontrolled recursion vulnerability, which can lead to application crashes when processing long inputs.
Vulnerability Detail
The vulnerability arises from the ClassUtils.getClass(...) method in Apache Commons Lang, which can trigger a StackOverflowError when handling excessively long input strings. This error is not typically managed by applications, potentially causing them to terminate unexpectedly. The issue affects versions 2.0 to 2.6 of commons-lang and versions 3.0 to 3.18.0 of commons-lang3, making it critical for users of these versions to take immediate action.
How To Fix
Minimum fixed version
3.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to limit the length of input strings passed to the ClassUtils.getClass(...) method. This can help prevent the StackOverflowError from occurring.
Conclusion
In summary, CVE-2025-48924 represents a significant vulnerability in Apache Commons Lang that can lead to application crashes due to uncontrolled recursion. Users are strongly advised to upgrade to the latest versions of the library to mitigate this risk.
See every vulnerability recorded for org.apache.commons:commons-lang3 →
FAQ
CVE-2025-48924 is a vulnerability in Apache Commons Lang that allows for uncontrolled recursion, potentially leading to application crashes.
The vulnerability affects commons-lang versions 2.0 to 2.6 and commons-lang3 versions 3.0 to 3.18.0.
The vulnerability can cause applications to terminate unexpectedly due to a StackOverflowError when processing long inputs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
