CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles
Uncontrolled Recursion vulnerability in Apache Commons.
When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0.
Users are recommended to upgrade to version 2.15.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Commons Configurationto a version that resolves this vulnerability.Fixed in 2.15.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45205?
CVE-2026-45205 is classified as a moderate severity vulnerability due to the potential for uncontrolled recursion leading to a StackOverflowError.
How do I fix CVE-2026-45205?
To fix CVE-2026-45205, upgrade Apache Commons Configuration to version 2.15.1 or later, which resolves the issue.
What types of applications are affected by CVE-2026-45205?
CVE-2026-45205 affects applications using Apache Commons Configuration version 2.2 to 2.15.0 that process YAML input with cycles.
What is the impact of CVE-2026-45205?
The impact of CVE-2026-45205 is that it can lead to application crashes due to StackOverflowError when handling untrusted YAML configurations with cycles.
Is CVE-2026-45205 exploitable remotely?
CVE-2026-45205 may be remotely exploitable if an attacker can input malicious YAML files into applications that do not validate configurations.