CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

"Gary D. Gregory" <[email protected]> Thu, 03 Oct 2024 11:26:22 +0000

Newsgroups	gmane.comp.jakarta.commons.user
Message-ID	<[email protected]>

Severity: low

Affected versions:

- Apache Commons IO 2.0 before 2.14.0

Description:

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.


This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Credit:

CodeQL (tool)

References:

https://commons.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-47554