CVE-2024-47554CWE-400

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Medium · published October 3, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01315 · 70.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-10-03T11:32Z
EPSS history
Timeline
  • 03 OCT 11:32Z
    Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
    cvelistv5