CVE-2026-45205: Apache Commons Configuration StackOverflowError for YAML Input with Cycles
Summary
CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles. Affects org.apache.commons:commons-configuration2 versions >= 2.2, < 2.15.0. Fixed in 2.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Configuration is a library that provides a flexible and comprehensive way to manage configuration data in Java applications. It supports various formats, including XML, properties files, and YAML. The library is widely used for its ability to handle complex configurations and its ease of integration into Java projects. However, it has a vulnerability that can lead to a StackOverflowError when processing YAML input that contains cycles, which can disrupt application functionality.
Vulnerability Detail
The vulnerability arises from uncontrolled recursion when Apache Commons Configuration processes untrusted YAML configuration files that contain cycles. This can lead to a StackOverflowError, causing the application to crash or become unresponsive. The issue affects versions of the library from 2.2 up to, but not including, 2.15.0. Attackers could exploit this vulnerability by crafting malicious YAML files, potentially leading to denial of service.
How To Fix
Latest published version: 2.15.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using YAML configuration files that may contain cycles. Validate and sanitize the input YAML files before processing them with Apache Commons Configuration to prevent potential crashes.
Conclusion
The StackOverflowError vulnerability in Apache Commons Configuration poses a risk when processing YAML files with cycles. Users are strongly advised to upgrade to version 2.15.0 or later to mitigate this issue. For those unable to upgrade immediately, validating and sanitizing input files can serve as a temporary workaround.
See every vulnerability recorded for org.apache.commons:commons-configuration2 →
FAQ
CVE-2026-45205 is a vulnerability in Apache Commons Configuration that can lead to a StackOverflowError when processing YAML files with cycles.
The vulnerability affects versions from 2.2 up to, but not including, 2.15.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
If an immediate upgrade is not possible, avoid using YAML files with cycles and validate your configuration files to prevent crashes.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.commons:commons-configuration2.
