org.apache.commons/commons-configuration2 vulnerabilities

Latest org.apache.commons/commons-configuration2 CVEs

Newest publication first

1. CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles

   Published 2026-05-14

   Medium·CVSS 5.3 EPSS 0.47%

   Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade t...

2. CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

   Published 2024-03-21

   High·CVSS 7.3 EPSS 2.1%

   Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

3. CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

   Published 2024-03-21

   Medium·CVSS 5.4 EPSS 1.7%

   Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

4. CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults

   Published 2022-07-06

   Critical·CVSS 9.8 EPSS 44.6%

   Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup...

5. CVE-2020-1953 Remote code execution in Apache Commons Configuration

   Published 2020-03-13

   Critical·CVSS 10.0 EPSS 6.3%

   Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this libr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.