Executive brief
Apache Commons Configuration is a Java library used by applications to manage configuration settings from various sources. A vulnerability exists where the library fails to properly handle certain malformed YAML files containing circular references. If an application uses this library to process untrusted configuration data, an attacker could cause the application to crash, leading to a denial-of-service condition.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in Apache Commons Configuration's YAMLConfiguration component. The root cause is the lack of cycle detection when parsing YAML input, which allows a specially crafted file with circular references to trigger a StackOverflowError. This is a network-reachable attack if the application accepts configuration files from untrusted sources. An attacker can exploit this to cause a crash (Denial of Service) of the Java Virtual Machine (JVM) process. The issue is fixed in version 2.15.0 by implementing cycle detection and avoidance during YAML processing.
Affected products
- Apache Software Foundation Commons Configuration2 2.2 to 2.14.0
Timeline
- 2026-05-11: patched: Fix merged into master branch via pull request 634
- 2026-05-14: disclosed: Vulnerability disclosed via oss-security mailing list and NVD
- 2026-05-14: advisory