Description
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Lang | 2.0 – ≤ 2.6, 3.0 – < 3.18.0 | 3.18.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcommons-lang-java | 2.6-11 | — |
| Debian 14 | libcommons-lang3-java | 3.17.0-2 | — |
| Debian 13 | libcommons-lang-java | 2.6-10+deb13u1 | — |
| Debian 13 | libcommons-lang3-java | 3.17.0-1+deb13u1 | — |
| Debian 12 | libcommons-lang-java | 2.6-10+deb12u1 | — |
| Debian 12 | libcommons-lang3-java | 3.12.0-2+deb12u1 | — |
| Debian 11 | libcommons-lang-java | 2.6-9+deb11u1 | DLA-4262-1 |
| Debian 11 | libcommons-lang3-java | 3.11-1+deb11u1 | DLA-4286-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | libcommons-lang3-java | No fix yet | — |
| Ubuntu 24.04 LTS | libcommons-lang-java | 2.6-10ubuntu0.1 | USN-8364-1 |
| Ubuntu 22.04 LTS | libcommons-lang-java | 2.6-9ubuntu0.22.04.1 | USN-8364-1 |
| Ubuntu 22.04 LTS | libcommons-lang3-java | 3.11-1ubuntu0.1 | USN-8364-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | libcommons-lang3-java | 3.14.0-1ubuntu0.1~esm1 | USN-8364-1 |
| Ubuntu Pro 20.04 LTS | libcommons-lang-java | 2.6-9ubuntu0.20.04.1~esm1 | USN-8364-1 |
| Ubuntu Pro 20.04 LTS | libcommons-lang3-java | 3.8-2ubuntu0.1~esm1 | USN-8364-1 |
| Ubuntu Pro 18.04 LTS | libcommons-lang-java | 2.6-8ubuntu0.1~esm1 | USN-8364-1 |
| Ubuntu Pro 18.04 LTS | libcommons-lang3-java | 3.8-1~18.04.2+esm1 | USN-8364-1 |
| Ubuntu Pro 16.04 LTS | libcommons-lang-java | 2.6-6ubuntu2+esm1 | USN-8364-1 |
| Ubuntu Pro 16.04 LTS | libcommons-lang3-java | 3.4-1ubuntu0.1~esm1 | USN-8364-1 |
| Ubuntu Pro 14.04 LTS | libcommons-lang-java | 2.6-3ubuntu2+esm1 | USN-8364-1 |
| Ubuntu Pro 14.04 LTS | libcommons-lang3-java | 3.2.1-1ubuntu0.1~esm1 | USN-8364-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | apache-commons-lang | 2.6-150200.14.3.1 | SUSE-SU-2025:02785-1 |
| SLES 15 SP7 | apache-commons-lang3 | 3.18.0-150200.3.12.1 | SUSE-SU-2026:3390-1, SUSE-SU-2025:02818-1 |
| SLES 15 SP7 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP7 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | apache-commons-lang | 2.6-150200.14.3.1 | SUSE-SU-2025:02785-1 |
| SLES 15 SP6 | apache-commons-lang3 | 3.18.0-150200.3.12.1 | SUSE-SU-2026:3390-1, SUSE-SU-2025:02818-1 |
| SLES 15 SP6 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP6 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP5 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES 15 SP4 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES 12 SP5 | apache-commons-lang | 2.6-5.3.1 | SUSE-SU-2025:02786-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | apache-commons-cli | 1.11.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 16.0 | apache-commons-codec | 1.22.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 16.0 | apache-commons-configuration2 | 2.15.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 16.0 | apache-commons-io | 2.22.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 16.0 | apache-commons-lang3 | 3.20.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 16.0 | apache-commons-text | 1.15.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES for SAP 15 SP6 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP6 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP5 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLES for SAP 15 SP4 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLES 16.0 | apache-commons-cli | 1.11.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES 16.0 | apache-commons-codec | 1.22.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES 16.0 | apache-commons-configuration2 | 2.15.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES 16.0 | apache-commons-io | 2.22.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES 16.0 | apache-commons-lang3 | 3.20.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLES 16.0 | apache-commons-text | 1.15.0-160000.1.1 | SUSE-SU-2026:21996-1 |
| SLE HPC 15 SP5 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP5 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | apache-commons-compress | 1.28.0-150200.3.21.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | apache-commons-lang3 | 3.20.0-150200.3.15.2 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | beust-jcommander | 1.83-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | google-guice | 6.0.0-150200.3.13.2 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | guava | 33.2.1-150200.3.15.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | jansi | 2.4.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | maven | 3.9.16-150200.4.33.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | maven-resolver | 1.9.27-150200.3.29.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | plexus-interpolation | 1.27.0-150200.3.9.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | plexus-xml | 3.0.1-150200.5.10.1 | SUSE-SU-2026:3390-1 |
| SLE HPC 15 SP4 | xmvn +3 | 4.3.0-150200.3.30.1 | SUSE-SU-2026:3390-1 |
| SUSE Manager Server Module 4.3 | apache-commons-lang3 | 3.18.0-150200.3.12.1 | SUSE-SU-2025:02818-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-configuration2 | 2.15.0-1.1 | openSUSE-SU-2026:10784-1 |
| openSUSE Tumbleweed | apache-commons-lang3 | 3.18.0-1.1 | openSUSE-SU-2025:15347-1 |
| openSUSE Leap 15.6 | apache-commons-lang | 2.6-150200.14.3.1 | SUSE-SU-2025:02785-1 |
| openSUSE Leap 15.6 | apache-commons-lang3 | 3.18.0-150200.3.12.1 | SUSE-SU-2025:02818-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | apache-commons-lang3 | 3.18.0-1.amzn2023.0.1 | ALAS2023-2025-1150 |
| Amazon Linux 2023 | javapackages-bootstrap | 1.5.0^20220105.git9f283b7-3.amzn2023.0.7 | ALAS2023-2025-1149 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | apache-commons-lang3 | 3.8.1-6 | — |
| Azure Linux 2 (CBL-Mariner) | apache-commons-lang3 | 3.8.1-6 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.0-r0 | — |
| Wolfi rolling | akhq | 0.26.0-r0 | — |
| Wolfi rolling | apache-activemq-artemis +1 | 2.42.0-r1 | — |
| Wolfi rolling | apache-nifi | 2.7.1-r0 | — |
| Wolfi rolling | apache-nifi-registry +1 | 2.4.0-r4 | — |
| Wolfi rolling | apache-tika-3.1 +1 | 3.1.0-r5 | — |
| Wolfi rolling | apache-tika-3.2 +1 | 3.2.1-r1 | — |
| Wolfi rolling | apicurio-registry +2 | 3.0.9-r5 | — |
| Wolfi rolling | cassandra-4.1 +1 | 4.1.9-r2 | — |
| Wolfi rolling | cassandra-reaper | 3.8.0-r7 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | confluent-kafka | 8.2.0.25-r0 | — |
| Wolfi rolling | cqlsh-5.0 +4 | 5.0.4-r1 | — |
| Wolfi rolling | debezium-connector-spanner-3.5 | 3.5.1-r1 | — |
| Wolfi rolling | dependency-track +1 | 4.13.2-r2 | — |
| Wolfi rolling | druid | 37.0.0-r14 | — |
| Wolfi rolling | flyway | 11.16.0-r0 | — |
| Wolfi rolling | gradle-8 | 8.14.3-r5 | — |
| Wolfi rolling | gradle-9 | 9.0.0-r1 | — |
| Wolfi rolling | jenkins-2-openjdk-21 +1 | 2.579-r0 | — |
| Wolfi rolling | jenkins-plugin-manager +1 | 2.13.2-r1 | — |
| Wolfi rolling | keycloak-config-cli +2 | 6.4.0-r45 | — |
| Wolfi rolling | kserve-modelmesh +1 | 0.12.0-r13 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.1-r4 | — |
| Wolfi rolling | management-api-for-apache-cassandra-5.0 | 0.1.109-r0 | — |
| Wolfi rolling | maven-stage0 | 3.9.12-r0 | — |
| Wolfi rolling | nextflow | 26.04.0-r0 | — |
| Wolfi rolling | nrjmx | 2.7.0-r3 | — |
| Wolfi rolling | sonar-scanner-cli +1 | 7.1.0.4889-r2 | — |
| Wolfi rolling | sonarqube | 25.11.0.114957-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.3-r2 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.2-r5 | — |
| Wolfi rolling | spdx-tools-java | 2.0.1-r5 | — |
| Wolfi rolling | tez +6 | No fix yet | — |
| Wolfi rolling | thingsboard +4 | 4.1-r1 | — |
| Wolfi rolling | wildfly +4 | 36.0.1-r6 | — |
| Wolfi rolling | zipkin +2 | 3.5.1-r8 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
njawalkar/apache-commons-lang2 ★ 0 · Oct 17, 2025
Apache's commons-lang2 v2.6 with a backported fix for CVE-2025-48924
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | commons-lang:commons-lang | >= 2.0, <= 2.6 | — | GHSA-j288-q9x7-2f5v |
| Maven | org.apache.commons:commons-lang3 | >= 3.0, < 3.18.0 | 3.18.0 | GHSA-j288-q9x7-2f5v |
Advisories 50
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-1210 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-2444 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2026
- WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
- SUSE-SU-2026:3390-1 Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn SUSE / openSUSE Security Updates · Jul 29, 2026
- WID-SEC-2025-1540 Apache Commons Lang: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 28, 2026
- WID-SEC-2026-2439 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2431 Oracle SQL Developer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- SUSE-SU-2026:21996-1 Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec SUSE / openSUSE Security Updates · Jun 9, 2026
- WID-SEC-2026-1032 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- USN-8364-1 libcommons-lang-java, libcommons-lang3-java vulnerability Ubuntu Security Notices (USN) · Jun 2, 2026
- openSUSE-SU-2026:10784-1 apache-commons-configuration2-2.15.0-1.1 on GA media SUSE / openSUSE Security Updates · May 17, 2026
- WID-SEC-2026-1212 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1206 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1203 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1200 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1198 Oracle Database Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- openSUSE-SU-2025:15347-1 apache-commons-lang3-3.18.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02818-1 Security update for apache-commons-lang3 SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4286-1 libcommons-lang3-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4262-1 libcommons-lang-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02785-1 Security update for apache-commons-lang3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02786-1 Security update for apache-commons-lang3 SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0029 Kwetsbaarheden verholpen in Oracle Hyperion NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0028 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0026 Kwetsbaarheden verholpen in Oracle Enterprise Manager NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0023 Kwetsbaarheden verholpen in Oracle PeopleSoft NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0021 Kwetsbaarheden verholpen in Oracle Database Server producten NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0020 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0154 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0173 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0170 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0167 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0166 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0165 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0158 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2359 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 23, 2025
- NCSC-2025-0334 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Nov 21, 2025
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0340 Kwetsbaarheden verholpen in Oracle PeopleSoft NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0333 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Oct 23, 2025
References
- https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1 vendor-advisory