Bug 2477425 (CVE-2026-45205)

Summary:	CVE-2026-45205 commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, dbruscin, dlofthou, drichtar, ehelms, ehugonne, ewittman, fmariani, ggainey, gmalinko, istudens, ivassile, iweiss, janstey, jpasqual, juwatts, jwon, kvanderr, mcarlett, mhulan, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, osousa, pantinor, pberan, pcreech, pesilva, pjindal, pmackay, rchan, rhel-process-autobot, rkubis, rmartinc, rstancel, rstepani, smallamp, ssilvert, sthorger, tcunning, thjenkin, tmalecek, vdosoudi, vmuzikar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-14 12:01:19 UTC

Uncontrolled Recursion vulnerability in Apache Commons.

When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles.
This issue affects Apache Commons: from 2.2 before 2.15.0.

Users are recommended to upgrade to version 2.15.0, which fixes the issue.

Comment 13 errata-xmlrpc 2026-08-13 14:50:53 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

Via RHSA-2026:54622 https://access.redhat.com/errata/RHSA-2026:54622

Comment 14 errata-xmlrpc 2026-09-10 16:35:03 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 15 errata-xmlrpc 2026-09-10 23:23:19 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545