CVE-2025-48924: Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48924?
CVE-2025-48924 has a high severity due to its potential to cause a StackOverflowError through uncontrolled recursion.
How do I fix CVE-2025-48924?
To fix CVE-2025-48924, upgrade to Apache Commons Lang version 3.18.0 or later.
Which versions are affected by CVE-2025-48924?
CVE-2025-48924 affects Apache Commons Lang versions 2.0 to 2.6 and Commons Lang 3 up to but not including 3.18.0.
What is the impact of CVE-2025-48924 on applications?
The impact of CVE-2025-48924 on applications can result in application crashes due to StackOverflowError.
Is there a workaround for CVE-2025-48924 before applying a fix?
There is no official known workaround for CVE-2025-48924, so upgrading is the recommended approach.