Summary
It was discovered that Apache Commons Lang incorrectly handled recursion
in the ClassUtils.getClass method. An attacker could possibly use this
issue to cause Apache Commons Lang to crash, resulting in a denial of
service.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libcommons-lang-java | 2.6-9ubuntu0.22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | libcommons-lang3-java | 3.11-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | libcommons-lang-java | 2.6-10ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libcommons-lang-java | 2.6-3ubuntu2+esm1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libcommons-lang3-java | 3.2.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libcommons-lang-java | 2.6-6ubuntu2+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libcommons-lang3-java | 3.4-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libcommons-lang-java | 2.6-8ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libcommons-lang3-java | 3.8-1~18.04.2+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libcommons-lang-java | 2.6-9ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libcommons-lang3-java | 3.8-2ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libcommons-lang3-java | 3.14.0-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 5.3CVE-2025-48924 Public exploit
Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…
References
-
report
https://ubuntu.com/security/CVE-2025-48924