CVE-2025-46392

published 2025-05-09

CVE-2025-46392: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that…

Priority P3 37 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.

There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.

Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	commons_configuration	>= 1.0 < 2.0	2.0
apache_software_foundation	apache_commons_configuration	>= 1 < 2.0.0	2.0.0
debian	commons-configuration	—	—
debian	commons-configuration2	—	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 6.5 MEDIUM

vendor_debian 6.5 MEDIUM

vendor_redhat 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400