CVE-2026-45205

Uncontrolled Recursion vulnerability in Apache Commons.

When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0.

Users are recommended to upgrade to version 2.15.0, which fixes the issue.

Red Hat Lightwell has released org.apache.commons:commons-configuration2 2.14.0.rhlw-00001 with a backported security fix.

CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles

This patched artifact is a drop-in replacement for org.apache.commons:commons-configuration2 2.14.0 from Maven Central.

Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.

TuxCare rebuilt 5 com.squareup.retrofit2 packages to address 3 CVEs. Fixed in 2.9.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.12.0-tuxcare.1.

TuxCare rebuilt 23 org.apache.logging.log4j packages to address 7 CVEs. Fixed in 2.11.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.11.0-tuxcare.1.

TuxCare rebuilt 2 com.jayway.jsonpath packages to address 3 CVEs. Fixed in 2.9.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.9.0-tuxcare.1.

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 2 CVEs. Fixed in 2.8.0-tuxcare.2.

These are all security issues fixed in the apache-commons-configuration2-2.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:

Changes in apache-commons-lang3:

Update to 3.20.0

• New features:

  • Add SystemProperties.getPath(String, Supplier<Path>)
  • Add JavaVersion.JAVA_25
  • Add JavaVersion.JAVA_26
  • Add SystemUtils.IS_JAVA_25
  • Add SystemUtils.IS_JAVA_26
  • Add MutablePair.ofNonNull(Map.Entry)
  • Add TimedSemaphore.builder(), Builder, and deprecate constructors
  • LANG-1504: Adding labels and history to split StopWatch

• Fixed Bugs:

  • Optimize ObjectToStringComparator.compare() method
  • [javadoc] Improve StringUtils Javadoc
  • Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum()
  • Use accessors in ToStringStyle so subclasses can effectively override them
  • 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException'
  • Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages
  • Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference()
  • LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils
  • LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console
  • LANG-1792: TypeUtils.toString() skips angle brackets for Class type
  • Mention JDK 25 LTS as a tested version in the release notes

• Changes:

  • Bump org.apache.commons:commons-parent from 88 to 92

• Update to 3.19.0

  • New features:

    • Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
    • Add SystemUtils.IS_OS_NETWARE
    • Add MethodUtils.getAccessibleMethod(Class, Method)
    • Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
    • Add StringUtils.indexOfAny(CharSequence, int, char...)
    • Add ConcurrentException.ConcurrentException(String)
    • Add DateUtils.toLocalDateTime(Date[, TimeZone])
    • Add DateUtils.toOffsetDateTime(Date[, TimeZone])
    • Add DateUtils.toZonedDateTime(Date[, TimeZone])
    • Add ByteConsumer
    • Add ByteSupplier
    • Add FailableByteConsumer
    • Add FailableByteSupplier
    • LANG-1784: Add Functions methods for null-safe mapping and chaining
    • LANG-1784: Add Failable methods for null-safe mapping and chaining
    • Add DoubleRange.fit(double)
    • Add IntegerRange.fit(int)
    • Add LongRange.fit(long)
    • Add DurationUtils.get(String, TemporalUnit, long)
    • Add DurationUtils.getMillis(String, long)
    • Add DurationUtils.getSeconds(String, long)
    • Add SystemProperties.getBoolean(Class, String, boolean)
    • Add SystemProperties.getInt(Class, String, int)
    • Add SystemProperties.getLong(Class, String, long)

  • Fixed Bugs:

    • LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods
    • MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types
    • Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods
    • MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass
    • AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException
    • LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException
    • LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values
    • MethodUtils cannot find or invoke vararg methods of interface types
    • MethodUtils…

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:

Changes in apache-commons-lang3:

Update to 3.20.0

• New features:

  • Add SystemProperties.getPath(String, Supplier<Path>)
  • Add JavaVersion.JAVA_25
  • Add JavaVersion.JAVA_26
  • Add SystemUtils.IS_JAVA_25
  • Add SystemUtils.IS_JAVA_26
  • Add MutablePair.ofNonNull(Map.Entry)
  • Add TimedSemaphore.builder(), Builder, and deprecate constructors
  • LANG-1504: Adding labels and history to split StopWatch

• Fixed Bugs:

  • Optimize ObjectToStringComparator.compare() method
  • [javadoc] Improve StringUtils Javadoc
  • Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum()
  • Use accessors in ToStringStyle so subclasses can effectively override them
  • 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException'
  • Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages
  • Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference()
  • LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils
  • LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console
  • LANG-1792: TypeUtils.toString() skips angle brackets for Class type
  • Mention JDK 25 LTS as a tested version in the release notes

• Changes:

  • Bump org.apache.commons:commons-parent from 88 to 92

• Update to 3.19.0

  • New features:

    • Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
    • Add SystemUtils.IS_OS_NETWARE
    • Add MethodUtils.getAccessibleMethod(Class, Method)
    • Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
    • Add StringUtils.indexOfAny(CharSequence, int, char...)
    • Add ConcurrentException.ConcurrentException(String)
    • Add DateUtils.toLocalDateTime(Date[, TimeZone])
    • Add DateUtils.toOffsetDateTime(Date[, TimeZone])
    • Add DateUtils.toZonedDateTime(Date[, TimeZone])
    • Add ByteConsumer
    • Add ByteSupplier
    • Add FailableByteConsumer
    • Add FailableByteSupplier
    • LANG-1784: Add Functions methods for null-safe mapping and chaining
    • LANG-1784: Add Failable methods for null-safe mapping and chaining
    • Add DoubleRange.fit(double)
    • Add IntegerRange.fit(int)
    • Add LongRange.fit(long)
    • Add DurationUtils.get(String, TemporalUnit, long)
    • Add DurationUtils.getMillis(String, long)
    • Add DurationUtils.getSeconds(String, long)
    • Add SystemProperties.getBoolean(Class, String, boolean)
    • Add SystemProperties.getInt(Class, String, int)
    • Add SystemProperties.getLong(Class, String, long)

  • Fixed Bugs:

    • LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods
    • MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types
    • Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods
    • MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass
    • AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException
    • LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException
    • LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values
    • MethodUtils cannot find or invoke vararg methods of interface types
    • MethodUtils…

This update for apache-commons-configuration2, apache-commons-text fixes the following issues

• CVE-2026-45205: uncontrolled recursion leads to StackOverflowError when processing specially crafted configuration files (bsc#1265299).

Changes for apache-commons-configuration2:

• Upgrade to version 2.15.0:

• Disable include schemes http[s] by default, see AbstractFileLocationStrategy
• Detect and avoid processing cycles in YAML input (YAMLConfiguration) (bsc#1265299, CVE-2026-45205)
• Extend scheme validation to inner schemes of jar: URLs
• Add XMLConfiguration.read(Element)
• Add ConfigurationException.ConfigurationException(String, Object...)
• Add ConfigurationException.ConfigurationException(Throwable, String, Object...)
• Add ConversionException.ConversionException(String, Object...)
• Add ConversionException.ConversionException(Throwable, String,
• Add ConfigurationRuntimeException .ConfigurationRuntimeException(Throwable, String, Object...)

• Fixed Bugs

• Fix Apache RAT plugin console warnings
• Migrate from deprecated APIs
• Add org.apache.commons.configuration2.ImmutableConfiguration .entrySet() .forEach(BiConsumer<String, Object>)
• Add VEX entry for CVE-2025-48924
• Shared primitive variable 'throwExceptionOnMissing' in one thread may not yield the value of the most recent write from another thread [org.apache.commons.configuration2 .AbstractConfiguration] At AbstractConfiguration.java: [line 1493] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
• Shared primitive variable 'forceSingleLine' in one thread may not yield the value of the most recent write from another thread [org.apache.commons.configuration2 .PropertiesConfigurationLayout] At PropertiesConfigurationLayout.java:[line 821] AT_STALE_THREAD_WRITE_OF_PRIMITIVE
• CONFIGURATION-849: Fix undoubling of strings
• CONFIGURATION-852: Mark the package jakarta.servlet.* import as optional in OSGi
• Fix build [WARNING] Parameter 'forkMode' is unknown for plugin 'maven-surefire-plugin:3.5.3:test (default-test)'

• New features:

• Add PrefixedKeysIterator.toString() to package-private PrefixedKeysIterator
• CONFIGURATION-836: New web configurations using the jakarta.servlet namespace are now available
• CONFIGURATION-836: Add org.apache.commons.configuration2.web .JakartaServletConfiguration .JakartaServletContextConfiguration .JakartaServletFilterConfiguration .JakartaServletRequestConfiguration
• Add org.apache.commons.configuration2 .AbstractHierarchicalConfiguration.getKeysInternal(String, String)

• Fixed Bugs:

• PropertyConverter.to(Class, Object, DefaultConversionHandler) doesn't convert custom java.lang.Number subclasses
• DefaultConversionHandler.convertValue(Object, Class, ConfigurationInterpolator) doesn't convert custom java.lang .Number subclasses
• DefaultConversionHandler.to(Object, Class,
• CONFIGURATION-848: SubsetConfiguration does not account for delimiters as it did in 2.9.0
• CONFIGURATION-848: CompositeConfiguration does not account for
• Describe the security model
• De-emphasize the 1.x version line on the website
• CONFIGURATION-851: HomeDirectoryLocationStrategy no longer resolves the user HOME directory correctly
• CONFIGURATION-844: Add support for empty sections
• Add ImmutableConfiguration.containsValue(Object)
• Fail-fast with a NullPointerException if DataConfiguration .DataConfiguration(Configuration) is called with null
• Fail-fast with a NullPointerException if XMLPropertiesConfiguration.XMLPropertiesConfiguration(Element) is called with null
• Fail-fast with a NullPointerException if a SubsetConfiguration constructor is called with a null Configuration
• CONFIGURATION-843: Methods should not be empty
• Guard MapConfiguration against null maps AppletConfiguration(Applet) is called with null ServletConfiguration(Servlet) is called with null ServletConfiguration(ServletConfig) is called with null ServletContextConfiguration(Servlet) is called with null …