CVE-2022-33980

CVE-2022-33980 affects Apache Commons Configuration (versions 2.4–2.7). The vulnerability arises in the default interpolation lookups, where interpolation of the form ${prefix:name} can trigger lookups such as script , dns , and url . These lookups could enable arbitrary code execution or contact...

CVE-2024-29131

The Apache Commons Configuration library is vulnerable to an out-of-bounds write (CWE-787) in versions 2.0 through 2.10.0 . This vulnerability allows for potential memory corruption. A fix is available in version 2.10.1 . The issue is also identified as affecting IBM SPSS Modeler version 19.0.0.0...

CVE-2024-29133

An out-of-bounds write vulnerability exists in Apache Commons Configuration versions from 2.0 before 2.10.1. This flaw is associated with CWE-787 and can impact the integrity and confidentiality of the application. The issue is also present in software packages including apache-hive and spark-sc2...

CVE-2020-1953

CVE-2020-1953 affects Apache Commons Configuration, where the YAML parser’s default behavior can instantiate arbitrary classes, enabling remote code execution if a crafted YAML file is loaded from an untrusted source. The vulnerability has been described across multiple sources, including IBM adv...

CVE-2026-45205

CVE-2026-45205 is an Uncontrolled Recursion vulnerability in Apache Commons Configuration (specifically affecting commons-configuration2-2.10.1.jar). When processing untrusted configuration files, the library can throw a StackOverflowError when encountering YAML input with cycles . This issue aff...

CVE-2025-46392

The Apache Commons Configuration 1.x library is susceptible to an uncontrolled resource consumption vulnerability (CWE-400) when loading untrusted configurations or through unexpected usage patterns. This issue can lead to a denial of service (DoS) condition, as evidenced by its impact on IBM Sto...