GHSA-pvp8-3xj6-8c6x
First published: Fri May 09 2025(Updated: )
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenarios where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/commons-configuration:commons-configuration | <=1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of GHSA-pvp8-3xj6-8c6x?
The severity of GHSA-pvp8-3xj6-8c6x is classified as high due to the potential for resource exhaustion.
How do I fix GHSA-pvp8-3xj6-8c6x?
To fix GHSA-pvp8-3xj6-8c6x, upgrade to Apache Commons Configuration 1.11 or later.
What are the main vulnerabilities associated with GHSA-pvp8-3xj6-8c6x?
GHSA-pvp8-3xj6-8c6x includes uncontrolled resource consumption issues that can lead to denial-of-service conditions.
What versions of Apache Commons Configuration are affected by GHSA-pvp8-3xj6-8c6x?
Apache Commons Configuration versions up to and including 1.10 are affected by GHSA-pvp8-3xj6-8c6x.
What is the impact of exploiting GHSA-pvp8-3xj6-8c6x?
Exploiting GHSA-pvp8-3xj6-8c6x can result in excessive resource consumption, leading to degraded system performance or crashes.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pvp8-3xj6-8c6x
- alias/CVE-2025-46392
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/source
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- package-manager/maven