Is CVE-2026-45205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45205 being exploited in the wild.

How severe is CVE-2026-45205?

Medium severity, with a CVSS score of 5.3, published 14 May 2026.

Which products and versions are affected?

Apache Software Foundation Commons Configuration 2.2 to 2.14.0, 2.2 to 2.14.x (before 2.15.0); Apache Software Foundation Commons Configuration2 2.2 to 2.14.0; org.apache.commons:commons-configuration2 (Maven) >= 2.2, < 2.15.0, ECOSYSTEM:introduced=2.2,fixed=2.15.0.

Is there a fix for CVE-2026-45205?

Yes. org.apache.commons:commons-configuration2 (Maven): upgrade to 2.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45205 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45205?

Check whether you run Apache Software Foundation Commons Configuration, Apache Software Foundation Commons Configuration2 or org.apache.commons:commons-configuration2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45205: Apache Commons Configuration uncontrolled recursion in YAMLConfiguration

Q: Is there a fix for CVE-2026-45205?

Yes. org.apache.commons:commons-configuration2 (Maven): upgrade to 2.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45205 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45205?

Check whether you run Apache Software Foundation Commons Configuration, Apache Software Foundation Commons Configuration2 or org.apache.commons:commons-configuration2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45205 · Severity: medium · CVSS 5.3 · Published 2026-05-14

Apache Commons Configuration is a Java library used by applications to manage configuration settings from various sources. A vulnerability exists where the library fails to properly handle certain malformed YAML files containing circular references. If an application uses this library to process untrusted configuration data, an attacker could cause the application to crash, leading to a denial-of-service condition.

Technologies: org.apache.commons:commons-configuration2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-45205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45205 being exploited in the wild.
How severe is CVE-2026-45205?: Medium severity, with a CVSS score of 5.3, published 14 May 2026.
Which products and versions are affected?: Apache Software Foundation Commons Configuration 2.2 to 2.14.0, 2.2 to 2.14.x (before 2.15.0); Apache Software Foundation Commons Configuration2 2.2 to 2.14.0; org.apache.commons:commons-configuration2 (Maven) >= 2.2, < 2.15.0, ECOSYSTEM:introduced=2.2,fixed=2.15.0.
Is there a fix for CVE-2026-45205?: Yes. org.apache.commons:commons-configuration2 (Maven): upgrade to 2.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45205 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45205?: Check whether you run Apache Software Foundation Commons Configuration, Apache Software Foundation Commons Configuration2 or org.apache.commons:commons-configuration2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.commons:commons-configuration2 (Maven): upgrade to 2.15.0 or later

# set org.apache.commons:commons-configuration2 to 2.15.0 in your pom.xml or build.gradle

Technical details

An uncontrolled recursion vulnerability (CWE-674) exists in Apache Commons Configuration's YAMLConfiguration component. The root cause is the lack of cycle detection when parsing YAML input, which allows a specially crafted file with circular references to trigger a StackOverflowError. This is a network-reachable attack if the application accepts configuration files from untrusted sources. An attacker can exploit this to cause a crash (Denial of Service) of the Java Virtual Machine (JVM) process. The issue is fixed in version 2.15.0 by implementing cycle detection and avoidance during YAML processing.

Affected products

Apache Software Foundation Commons Configuration2 2.2 to 2.14.0

Identifiers

CVE-2026-45205
GHSA-337m-mw94-2v6g

Timeline

2026-05-11: patched: Fix merged into master branch via pull request 634
2026-05-14: disclosed: Vulnerability disclosed via oss-security mailing list and NVD
2026-05-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.