CVE-2024-29131
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
CVE-2024-29131- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2024-1045
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
EUVD-2024-1045- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xjp4-hw94-mvp5
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
This Out-of-bounds Write vulnerability in Apache Commons Configuration affects Apache Commons Configuration: from 2.0 before 2.10.1. User can see this as a 'StackOverflowError' when adding a property in 'AbstractListDelimiterHandler.flattenIterator()'. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
GHSA-xjp4-hw94-mvp5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
CVE-2024-29131- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
CVE-2024-29131- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-29131
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
DEBIAN-CVE-2024-29131- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-xjp4-hw94-mvp5
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
This Out-of-bounds Write vulnerability in Apache Commons Configuration affects Apache Commons Configuration: from 2.0 before 2.10.1. User can see this as a 'StackOverflowError' when adding a property in 'AbstractListDelimiterHandler.flattenIterator()'. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
GHSA-xjp4-hw94-mvp5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-29131
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
- Record
UBUNTU-CVE-2024-29131- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1789201689 No score
TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2.
- Record
CLSA-2026-1789201689- Updated
- 2026-11-02
OSVCLSA-2026-1792011149 No score
TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.9.0-tuxcare.2.
- Record
CLSA-2026-1792011149- Updated
- 2026-11-02
OSVCLSA-2026-1793122844 No score
TuxCare security update for org.apache.commons:commons-configuration2 (2 CVEs)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 2 CVEs. Fixed in 2.8.0-tuxcare.2.
- Record
CLSA-2026-1793122844- Updated
- 2026-11-02
OSVCLSA-2026-1793128350 No score
TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.1.1-tuxcare.1.
- Record
CLSA-2026-1793128350- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13791-1 No score
apache-commons-configuration2-2.10.1-1.1 on GA media
These are all security issues fixed in the apache-commons-configuration2-2.10.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13791-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1365-1 No score
Security update for apache-commons-configuration2
This update for apache-commons-configuration2 fixes the following issues:
- CVE-2024-29131: Fixed StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() (bsc#1221797).
- CVE-2024-29133: Fixed StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree (bsc#1221793).
- Record
SUSE-SU-2024:1365-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1377-1 No score
Security update for apache-commons-configuration
This update for apache-commons-configuration fixes the following issues:
- CVE-2024-29131: Fixed StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() (bsc#1221797).
- CVE-2024-29133: Fixed StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree (bsc#1221793).
- Record
SUSE-SU-2024:1377-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.commons:commons-configuration2Maven |
2.0 up to 2.10.1 | 2.10.1 |
commons-configuration:commons-configurationTuxCare:Maven |
1.10 up to 1.10-tuxcare.2, plus listed versions 1.10-tuxcare.1 |
1.10-tuxcare.2 |
org.apache.commons:commons-configuration2TuxCare:Maven |
2.9.0 up to 2.9.0-tuxcare.2, plus listed versions 2.9.0-tuxcare.1 |
2.9.0-tuxcare.2 |
org.apache.commons:commons-configuration2TuxCare:Maven From an advisory covering 2 CVEs |
2.8.0 up to 2.8.0-tuxcare.2, plus listed versions 2.8.0-tuxcare.1 |
2.8.0-tuxcare.2 |
org.apache.commons:commons-configuration2TuxCare:Maven |
2.1.1 up to 2.1.1-tuxcare.1 | 2.1.1-tuxcare.1 |
commons-configuration2Debian:12 |
All versions, plus listed versions 2.10.1-12.11.0-12.11.0-22.11.0-32.15.1-12.8.0-2 |
None known |
commons-configuration2Debian:13 |
before 2.10.1-1 | 2.10.1-1 |
commons-configuration2Debian:14 |
before 2.10.1-1 | 2.10.1-1 |
org.apache.commons:commons-configuration2Maven |
2.0 up to 2.10.1, plus listed versions 2.12.1.12.10.02.22.3 Show 6 moreShow less2.42.52.62.72.8.02.9.0 |
2.10.1 |
apache-commons-configuration2SUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-commons-configuration2SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2SUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configuration2openSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 2.10.1-150200.5.8.1 | 2.10.1-150200.5.8.1 |
apache-commons-configurationSUSE:Linux Enterprise Module for Development Tools 15 SP5 From an advisory covering 2 CVEs |
before 1.10-150200.3.11.1 | 1.10-150200.3.11.1 |
apache-commons-configurationopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 1.10-150200.3.11.1 | 1.10-150200.3.11.1 |
commons-configuration2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.1.1-12.2-1 |
None known |
commons-configuration2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.2-1 |
None known |
commons-configuration2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.7-2 |
None known |
commons-configuration2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.8.0-2 |
None known |
apache-commons-configuration2openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.10.1-1.1 | 2.10.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29131 is a high vulnerability (CVSS 7.3) in Apache Commons Configuration, published March 21, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in org.apache.commons:commons-configuration2 2.10.1.
References
lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37
lists.fedoraproject.org/archives/list/[email protected]/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS
openwall.com/lists/oss-security/2024/03/20/4
security.netapp.com/advisory/ntap-20241213-0001
nvd.nist.gov/vuln/detail/CVE-2024-29131
Show 15 moreShow less
github.com/apache/commons-configuration/commit/56b5c4dcdffbde27870df5a3105d6a5f9b22f554
issues.apache.org/jira/browse/CONFIGURATION-840
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2024-29131
suse.com/support/update/announcement/2024/suse-su-20241365-1
bugzilla.suse.com/1221793
ubuntu.com/security/CVE-2024-29131
cve.org/CVERecord?id=CVE-2024-29131