Uncontrolled Recursion Vulnerability in Apache Commons Lang - libcommons-lang-java and libcommons-lang3-java
Summary
CVE-2025-48924: Uncontrolled Recursion vulnerability in Apache Commons Lang. Affects libcommons-lang-java across 2 version ranges.
< 2.6-9+deb11u1
>= da5d64110a8b7182d04359958f40fadfbe1ed6ff, < 631f3ce18ed9ae276b34105592a13f32df200260
Fixed in 2.6-9+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Commons Lang is a widely used Java library that provides utility functions for the Java programming language. It enhances the core Java API with additional functionality, making it easier for developers to work with Java objects. The library includes features for string manipulation, number handling, and reflection, among others. However, certain versions of this library are vulnerable to an uncontrolled recursion issue that can lead to application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2025-48924, arises from the methods ClassUtils.getClass(...) in Apache Commons Lang. This issue affects versions of commons-lang from 2.0 to 2.6 and org.apache.commons:commons-lang3 from 3.0 to 3.18.0. The vulnerability can cause a StackOverflowError when processing very long inputs, which is typically not handled by applications. As a result, this can lead to unexpected application termination, posing a risk to system stability and reliability.
How To Fix
Minimum fixed version
2.6-9+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-lang-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to limit the length of inputs passed to the ClassUtils.getClass(...) method, thereby preventing the StackOverflowError from occurring.
Conclusion
CVE-2025-48924 presents a significant risk to applications using affected versions of Apache Commons Lang. It is crucial for developers to upgrade to the patched version to ensure application stability and prevent unexpected crashes. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for libcommons-lang-java →
FAQ
CVE-2025-48924 is a vulnerability in Apache Commons Lang that can lead to a StackOverflowError due to uncontrolled recursion when processing long inputs.
The vulnerability affects commons-lang versions from 2.0 to 2.6 and org.apache.commons:commons-lang3 versions from 3.0 to 3.18.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Failure to address this vulnerability may result in application crashes and instability, potentially affecting user experience and system reliability.
Yes, upgrading to version 3.18.0 or later of the Apache Commons Lang library will fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-lang-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
