Uncontrolled Recursion Vulnerability in Apache Commons Lang: libcommons-lang-java and libcommons-lang3-java
Summary
UBUNTU-CVE-2025-48924: Uncontrolled Recursion vulnerability in Apache Commons Lang. Affects libcommons-lang-java versions 2.6-3ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Lang is a widely used library that provides utility methods for Java programming, enhancing the standard Java API. The library includes classes for manipulating core Java classes, such as String, Date, and Class. The vulnerability in question affects versions of the library from 2.0 to 2.6 for commons-lang and from 3.0 to before 3.18.0 for commons-lang3, making it susceptible to uncontrolled recursion issues.
Vulnerability Detail
The vulnerability arises from the methods ClassUtils.getClass(...) in Apache Commons Lang, which can throw a StackOverflowError when processing very long inputs. This uncontrolled recursion can lead to application crashes, as the StackOverflowError is typically not handled by applications or libraries. The issue affects versions of commons-lang from 2.0 to 2.6 and commons-lang3 from 3.0 to 3.18.0, potentially causing significant disruptions in applications relying on these libraries.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation to limit the length of inputs passed to the ClassUtils.getClass(...) method, thereby preventing the StackOverflowError from occurring.
Conclusion
The uncontrolled recursion vulnerability in Apache Commons Lang affects multiple versions of libcommons-lang-java and libcommons-lang3-java. Users are strongly advised to upgrade to the patched versions to avoid potential application crashes and ensure stability. Implementing input validation can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for libcommons-lang-java →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Affected versions include commons-lang from 2.0 to 2.6 and commons-lang3 from 3.0 to before 3.18.0.
If left unaddressed, the vulnerability can lead to application crashes due to StackOverflowError, disrupting service and user experience.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without signup.
Yes, implementing input validation to restrict the length of inputs to the ClassUtils.getClass(...) method can serve as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-lang-java.
