Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

2024-03-2109:31:14

Google

osv.dev

apache commons configuration

stackoverflowerror

listdelimiterhandler

out-of-bounds write

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

This Out-of-bounds Write vulnerability in Apache Commons Configuration affects Apache Commons Configuration: from 2.0 before 2.10.1. User can see this as a ‘StackOverflowError’ calling ‘ListDelimiterHandler.flatten(Object, int)’ with a cyclical object tree.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.

CPENameOperatorVersion
org.apache.commons:commons-configuration2eq2.7
org.apache.commons:commons-configuration2eq2.0
org.apache.commons:commons-configuration2eq2.9.0
org.apache.commons:commons-configuration2eq2.1
org.apache.commons:commons-configuration2eq2.5
org.apache.commons:commons-configuration2eq2.6
org.apache.commons:commons-configuration2eq2.3
org.apache.commons:commons-configuration2eq2.2
org.apache.commons:commons-configuration2eq2.10.0
org.apache.commons:commons-configuration2eq2.1.1

Name	Operator	Version
org.apache.commons:commons-configuration2	eq	2.7
org.apache.commons:commons-configuration2	eq	2.0
org.apache.commons:commons-configuration2	eq	2.9.0
org.apache.commons:commons-configuration2	eq	2.1
org.apache.commons:commons-configuration2	eq	2.5
org.apache.commons:commons-configuration2	eq	2.6
org.apache.commons:commons-configuration2	eq	2.3
org.apache.commons:commons-configuration2	eq	2.2
org.apache.commons:commons-configuration2	eq	2.10.0
org.apache.commons:commons-configuration2	eq	2.1.1