CVE-2025-46392
Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
CVE-2025-46392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-14160
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
EUVD-2025-14160- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pvp8-3xj6-8c6x
Apache Commons Configuration Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenarios where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
GHSA-pvp8-3xj6-8c6x- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
CVE-2025-46392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
CVE-2025-46392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-46392
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
DEBIAN-CVE-2025-46392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-pvp8-3xj6-8c6x
Apache Commons Configuration Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenarios where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
GHSA-pvp8-3xj6-8c6x- CVSS 4.0
- 2.7 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-46392
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
- Record
UBUNTU-CVE-2025-46392- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1791205000 No score
TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.3.
- Record
CLSA-2026-1791205000- Updated
- 2026-11-02
OSVCLSA-2026-1792010667 No score
TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.9-tuxcare.2.
- Record
CLSA-2026-1792010667- Updated
- 2026-11-02
OSVCLSA-2026-1792014556 No score
TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.2.
- Record
CLSA-2026-1792014556- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
commons-configuration:commons-configurationMaven |
through 1.10 | None known |
commons-configuration:commons-configurationTuxCare:Maven |
1.10 up to 1.10-tuxcare.3, plus listed versions 1.10-tuxcare.11.10-tuxcare.2 |
1.10-tuxcare.3 |
commons-configuration:commons-configurationTuxCare:Maven |
1.9 up to 1.9-tuxcare.2, plus listed versions 1.9-tuxcare.1 |
1.9-tuxcare.2 |
commons-configuration:commons-configurationTuxCare:Maven |
1.8 up to 1.8-tuxcare.2, plus listed versions 1.8-tuxcare.1 |
1.8-tuxcare.2 |
commons-configurationDebian:12 |
All versions, plus listed versions 1.10-61.10-7 |
None known |
commons-configurationDebian:13 |
All versions, plus listed versions 1.10-7 |
None known |
commons-configurationDebian:14 |
All versions, plus listed versions 1.10-7 |
None known |
commons-configuration:commons-configurationMaven |
through 1.10, plus listed versions 1.01.0-dev-2.20021231.0452541.0-dev-3.20030603.1012001.0-dev-3.20030607.1941551.0-rc1 Show 12 moreShow less1.0-rc21.11.21.2RC11.2RC21.31.41.51.61.71.81.9 |
None known |
commons-configurationUbuntu:14.04:LTS |
All versions, plus listed versions 1.9-11.10-1 |
None known |
commons-configurationUbuntu:16.04:LTS |
All versions, plus listed versions 1.10-3ubuntu11.10-4ubuntu1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
commons-configurationUbuntu:18.04:LTS |
All versions, plus listed versions 1.10-5 |
None known |
commons-configurationUbuntu:20.04:LTS |
All versions, plus listed versions 1.10-5 |
None known |
commons-configurationUbuntu:22.04:LTS |
All versions, plus listed versions 1.10-5 |
None known |
commons-configurationUbuntu:24.04:LTS |
All versions, plus listed versions 1.10-6 |
None known |
commons-configurationUbuntu:25.10 |
All versions, plus listed versions 1.10-7 |
None known |
commons-configurationUbuntu:26.10 |
All versions, plus listed versions 1.10-7build1 |
None known |
commons-configurationUbuntu:26.04:LTS |
All versions, plus listed versions 1.10-71.10-7build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46392 is a medium vulnerability (CVSS 6.5) in Apache Commons Configuration, published May 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 82nd percentile. Fixed in commons-configuration:commons-configuration 1.10-tuxcare.3.