CVE-2025-48924

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

The standard Java libraries fail to provide enough methods for manipulation of its core classes. The Commons Lang Component provides these extra methods. Lang provides a host of helper utilities for the java.lang API, notably String manipulation methods, basic numerical methods, object reflection, concurrency, creation and serialization and System properties. Additionally it contains basic enhancements to java.util.Date and a series of utilities dedicated to help with building methods, such as hashCode, toString and equals. Note that Lang 3.0 (and subsequent versions) use a different package (org.apache.commons.lang3) than the previous versions (org.apache.commons.lang), allowing it to be used at the same time as an earlier version.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

The standard Java libraries fail to provide enough methods for manipulation of its core classes. Apache Commons Lang provides these extra methods.

Security Fix(es):

A vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)

Red Hat Lightwell has released org.apache.commons:commons-lang3 3.17.0.rhlw-00011 with a backported security fix.

CVE-2025-48924: Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

This patched artifact is a drop-in replacement for org.apache.commons:commons-lang3 3.17.0 from Maven Central.

Root has patched CVE-2025-48924 in the io.root.org.apache.commons:commons-lang3 package for Root:Maven. Multiple fixed versions available.

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

TuxCare rebuilt commons-lang:commons-lang to address 1 CVE. Fixed in 2.4-tuxcare.1.

TuxCare rebuilt commons-lang:commons-lang to address 1 CVE. Fixed in 2.6-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.4-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.10-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.12.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.8.1-tuxcare.1.

TuxCare rebuilt 15 org.apache.maven packages to address 1 CVE. Fixed in 3.8.1-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.17.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.14.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.11-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.16.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.9-tuxcare.1.

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs. (CVE-2025-48924)

These are all security issues fixed in the apache-commons-lang3-3.18.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache-commons-configuration2-2.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:

Changes in apache-commons-lang3:

Update to 3.20.0

• New features:

  • Add SystemProperties.getPath(String, Supplier<Path>)
  • Add JavaVersion.JAVA_25
  • Add JavaVersion.JAVA_26
  • Add SystemUtils.IS_JAVA_25
  • Add SystemUtils.IS_JAVA_26
  • Add MutablePair.ofNonNull(Map.Entry)
  • Add TimedSemaphore.builder(), Builder, and deprecate constructors
  • LANG-1504: Adding labels and history to split StopWatch

• Fixed Bugs:

  • Optimize ObjectToStringComparator.compare() method
  • [javadoc] Improve StringUtils Javadoc
  • Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum()
  • Use accessors in ToStringStyle so subclasses can effectively override them
  • 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException'
  • Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages
  • Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference()
  • LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils
  • LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console
  • LANG-1792: TypeUtils.toString() skips angle brackets for Class type
  • Mention JDK 25 LTS as a tested version in the release notes

• Changes:

  • Bump org.apache.commons:commons-parent from 88 to 92

• Update to 3.19.0

  • New features:

    • Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
    • Add SystemUtils.IS_OS_NETWARE
    • Add MethodUtils.getAccessibleMethod(Class, Method)
    • Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
    • Add StringUtils.indexOfAny(CharSequence, int, char...)
    • Add ConcurrentException.ConcurrentException(String)
    • Add DateUtils.toLocalDateTime(Date[, TimeZone])
    • Add DateUtils.toOffsetDateTime(Date[, TimeZone])
    • Add DateUtils.toZonedDateTime(Date[, TimeZone])
    • Add ByteConsumer
    • Add ByteSupplier
    • Add FailableByteConsumer
    • Add FailableByteSupplier
    • LANG-1784: Add Functions methods for null-safe mapping and chaining
    • LANG-1784: Add Failable methods for null-safe mapping and chaining
    • Add DoubleRange.fit(double)
    • Add IntegerRange.fit(int)
    • Add LongRange.fit(long)
    • Add DurationUtils.get(String, TemporalUnit, long)
    • Add DurationUtils.getMillis(String, long)
    • Add DurationUtils.getSeconds(String, long)
    • Add SystemProperties.getBoolean(Class, String, boolean)
    • Add SystemProperties.getInt(Class, String, int)
    • Add SystemProperties.getLong(Class, String, long)

  • Fixed Bugs:

    • LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods
    • MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types
    • Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods
    • MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass
    • AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException
    • LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException
    • LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values
    • MethodUtils cannot find or invoke vararg methods of interface types
    • MethodUtils…

This update for apache-commons-lang3 fixes the following issues:

• CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

This update for apache-commons-lang3 fixes the following issues:

• CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

This update for apache-commons-lang3 fixes the following issues:

• Update to version 3.18.0
• CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:

Changes in apache-commons-lang3:

Update to 3.20.0

• New features:

  • Add SystemProperties.getPath(String, Supplier<Path>)
  • Add JavaVersion.JAVA_25
  • Add JavaVersion.JAVA_26
  • Add SystemUtils.IS_JAVA_25
  • Add SystemUtils.IS_JAVA_26
  • Add MutablePair.ofNonNull(Map.Entry)
  • Add TimedSemaphore.builder(), Builder, and deprecate constructors
  • LANG-1504: Adding labels and history to split StopWatch

• Fixed Bugs:

  • Optimize ObjectToStringComparator.compare() method
  • [javadoc] Improve StringUtils Javadoc
  • Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum()
  • Use accessors in ToStringStyle so subclasses can effectively override them
  • 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException'
  • Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages
  • Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference()
  • LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils
  • LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console
  • LANG-1792: TypeUtils.toString() skips angle brackets for Class type
  • Mention JDK 25 LTS as a tested version in the release notes

• Changes:

  • Bump org.apache.commons:commons-parent from 88 to 92

• Update to 3.19.0

  • New features:

    • Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
    • Add SystemUtils.IS_OS_NETWARE
    • Add MethodUtils.getAccessibleMethod(Class, Method)
    • Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
    • Add StringUtils.indexOfAny(CharSequence, int, char...)
    • Add ConcurrentException.ConcurrentException(String)
    • Add DateUtils.toLocalDateTime(Date[, TimeZone])
    • Add DateUtils.toOffsetDateTime(Date[, TimeZone])
    • Add DateUtils.toZonedDateTime(Date[, TimeZone])
    • Add ByteConsumer
    • Add ByteSupplier
    • Add FailableByteConsumer
    • Add FailableByteSupplier
    • LANG-1784: Add Functions methods for null-safe mapping and chaining
    • LANG-1784: Add Failable methods for null-safe mapping and chaining
    • Add DoubleRange.fit(double)
    • Add IntegerRange.fit(int)
    • Add LongRange.fit(long)
    • Add DurationUtils.get(String, TemporalUnit, long)
    • Add DurationUtils.getMillis(String, long)
    • Add DurationUtils.getSeconds(String, long)
    • Add SystemProperties.getBoolean(Class, String, boolean)
    • Add SystemProperties.getInt(Class, String, int)
    • Add SystemProperties.getLong(Class, String, long)

  • Fixed Bugs:

    • LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods
    • MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types
    • Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods
    • MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass
    • AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException
    • LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException
    • LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values
    • MethodUtils cannot find or invoke vararg methods of interface types
    • MethodUtils…

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues:

apache-commons-lang3 was updated to 3.20.0:

• New features:

  • Add SystemProperties.getPath(String, Supplier<Path>)
  • Add JavaVersion.JAVA_25
  • Add JavaVersion.JAVA_26
  • Add SystemUtils.IS_JAVA_25
  • Add SystemUtils.IS_JAVA_26
  • Add MutablePair.ofNonNull(Map.Entry)
  • Add TimedSemaphore.builder(), Builder, and deprecate constructors
  • LANG-1504: Adding labels and history to split StopWatch

• Fixed Bugs:

  • Optimize ObjectToStringComparator.compare() method
  • [javadoc] Improve StringUtils Javadoc
  • Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum()
  • Use accessors in ToStringStyle so subclasses can effectively override them
  • 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException'
  • Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages
  • Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference()
  • LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils
  • LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console
  • LANG-1792: TypeUtils.toString() skips angle brackets for Class type
  • Mention JDK 25 LTS as a tested version in the release notes

• Changes:

  • Bump org.apache.commons:commons-parent from 88 to 92

Update to 3.19.0:

• New features:
  • Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
  • Add SystemUtils.IS_OS_NETWARE
  • Add MethodUtils.getAccessibleMethod(Class, Method)
  • Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
  • Add StringUtils.indexOfAny(CharSequence, int, char...)
  • Add ConcurrentException.ConcurrentException(String)
  • Add DateUtils.toLocalDateTime(Date[, TimeZone])
  • Add DateUtils.toOffsetDateTime(Date[, TimeZone])
  • Add DateUtils.toZonedDateTime(Date[, TimeZone])
  • Add ByteConsumer
  • Add ByteSupplier
  • Add FailableByteConsumer
  • Add FailableByteSupplier
  • LANG-1784: Add Functions methods for null-safe mapping and chaining
  • LANG-1784: Add Failable methods for null-safe mapping and chaining
  • Add DoubleRange.fit(double)
  • Add IntegerRange.fit(int)
  • Add LongRange.fit(long)
  • Add DurationUtils.get(String, TemporalUnit, long)
  • Add DurationUtils.getMillis(String, long)
  • Add DurationUtils.getSeconds(String, long)
  • Add SystemProperties.getBoolean(Class, String, boolean)
  • Add SystemProperties.getInt(Class, String, int)
  • Add SystemProperties.getLong(Class, String, long)
• Fixed Bugs:
  • LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods
  • MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types
  • Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods
  • MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass
  • AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException
  • LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException
  • LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values
  • MethodUtils cannot find or invoke vararg methods of interface types
  • MethodUtils cannot find or invoke vararg methods when widening primitive types following…

It was discovered that Apache Commons Lang incorrectly handled recursion in the ClassUtils.getClass method. An attacker could possibly use this issue to cause Apache Commons Lang to crash, resulting in a denial of service.