Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-48924

23
FAUCET Score

CVE-2025-48924 is an Uncontrolled Recursion vulnerability in Apache Commons Lang, affecting versions 2.0 to 2.6 and 3.0 before 3.18.0. Specifically, the ClassUtils.getClass(...) methods can be exploited with very long inputs to trigger a StackOverflowError, potentially causing application crashes. This vulnerability has a CVSS score of 5.3 (Medium) with a low impact on availability, requiring no user interaction or privileges. There is currently no evidence of active exploitation, public exploit code, or significant media coverage, though it has been mentioned in a GitHub fix.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.0, < 2.6CPE matchmatch criteria
cpe:2.3:a:apache:commons_lang:*:*:*:*:*:*:*:*
>= 3.0, < 3.18.0CPE matchmatch criteria
cpe:2.3:a:apache:commons_lang:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.16%
Probability of exploitation in next 30 days
EPSS Percentile
80.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0216 is in the 70th percentile among its peer group of 23,705 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (160)

mavenpatch availablevia ghsa
Product: org.apache.commons:commons-lang3Fixed in: 3.18.0
microsoftpatch availablevia msrc
Product: cbl2 apache-commons-lang3 3.8.1-5 on CBL Mariner 2.0Fixed in: 3.8.1-6
microsoftpatch availablevia msrc
Product: 20391-17086Fixed in: 3.8.1-6
microsoftpatch availablevia msrc
Product: azl3 apache-commons-lang3 3.8.1-6 on Azure Linux 3.0Fixed in: 3.8.1-6
microsoftpatch availablevia msrc
Product: 20181-17086Fixed in: 3.8.1-6
microsoftpatch availablevia msrc
Product: cbl2 apache-commons-lang3 3.8.1-6 on CBL Mariner 2.0Fixed in: 3.8.1-6
microsoftpatch availablevia msrc
Product: 20187-17084Fixed in: 3.8.1-6
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 3.1.0Fixed in: commons-lang3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
View patch
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 2.9.2
View patch
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 3.0.0
View patch
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 3.0.1
View patch
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (noble)Fixed in: 2.6-10ubuntu0.1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (noble)Fixed in: 3.14.0-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (trusty)Fixed in: 2.6-3ubuntu2+esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (trusty)Fixed in: 3.2.1-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (xenial)Fixed in: 2.6-6ubuntu2+esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (xenial)Fixed in: 3.4-1ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (jammy)Fixed in: 3.11-1ubuntu0.1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (jammy)Fixed in: 2.6-9ubuntu0.22.04.1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (focal)Fixed in: 3.8-2ubuntu0.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (focal)Fixed in: 2.6-9ubuntu0.20.04.1~esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang3-java (bionic)Fixed in: 3.8-1~18.04.2+esm1
ubuntupatch availablevia ubuntu_usn
Product: libcommons-lang-java (bionic)Fixed in: 2.6-8ubuntu0.1~esm1
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-sail-operator-bundle
redhatvendor investigatingvia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: python3.11-drools-jpy-jar
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel 4 for Quarkus 3Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel for Spring Boot 4Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 3Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 3Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Debezium 2Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Debezium 2Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Debezium 3Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Debezium 3Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Build of KeycloakFixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of OptaPlanner 8Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat build of OptaPlanner 8Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat build of QuarkusFixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Certificate System 10Fixed in: redhat-pki:10/jss
redhatvendor investigatingvia redhat_api
Product: Red Hat Certificate System 10Fixed in: redhat-pki:10/redhat-pki
redhatvendor investigatingvia redhat_api
Product: Red Hat Data Grid 8Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat Data Grid 8Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: jakarta-mail
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: qdox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: qpid-cpp
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: qpid-qmf
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: exec-maven-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-changes-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-doxia
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-ear-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-enforcer
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-javadoc-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-release
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-scm
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-shade-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-surefire
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-wagon
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: velocity
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/exec-maven-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-compiler-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-dependency-analyzer
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-dependency-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-dependency-tree
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-doxia
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-doxia-sitetools
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-enforcer
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-jar-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-shade-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/maven-surefire
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/plexus-compiler
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/qdox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: javapackages-tools:201801/slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: log4j:2/log4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: maven:3.8/slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pki-core:10.6/jss
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pki-deps:10.6/jackson-modules-base
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pki-deps:10.6/slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: jackson-modules-base
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: jakarta-mail
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: jmc
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: jss
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: log4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven:3.8/slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven:3.9/slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven-dependency-tree
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven-enforcer
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven-jar-plugin
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: maven-resolver
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: pki-core
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: qdox
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: slf4j
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Web Server 5Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Web Server 5Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Web Server 6Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Web Server 6Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Offline Knowledge PortalFixed in: offline-knowledge-portal/rhokp-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/idea-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/server-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/server-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces-tech-preview/idea-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Red Hat Process Automation 7Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: candlepin
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: puppetserver
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: satellite-capsule:el8/puppetserver
redhatvendor investigatingvia redhat_api
Product: Red Hat Satellite 6Fixed in: satellite:el8/candlepin
redhatvendor investigatingvia redhat_api
Product: Red Hat Single Sign-On 7Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: streams for Apache Kafka 2Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: streams for Apache Kafka 2Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Single Sign-On 7Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: maven-jxr
redhatvendor investigatingvia redhat_api
Product: AMQ ClientsFixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: AMQ ClientsFixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: commons-lang
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: commons-lang3
redhatvendor investigatingvia redhat_api
Product: OpenShift Developer Tools and ServicesFixed in: jenkins
redhatvendor investigatingvia redhat_api
Product: OpenShift Developer Tools and ServicesFixed in: jenkins-2-plugins
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-log-sink-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-timer-source-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-cni-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-must-gather-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-pilot-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/istio-proxyv2-rhel9

Vendor Advisories (4)

ubuntuUSN-8364-1

Apache Commons Lang vulnerability

Jun 2, 2026
mavenGHSA-j288-q9x7-2f5vmedium

Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs

Jul 11, 2025
redhatCVE-2025-48924Low

commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang

Jul 11, 2025
microsoft2025-Jul/CVE-2025-48924

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Jul 8, 2025

References

lists.debian.org / debian-lts-announce/2025/08/msg00000.html
lists.debian.org / debian-lts-announce/2025/08/msg00026.html
lists.debian.org / debian-lts-announce/2025/09/msg00032.html
lists.debian.org / debian-lts-announce/2025/09/msg00036.html
openwall.com / lists/oss-security/2025/07/11/1
lists.apache.org / thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1
Mailing ListVendor Advisory