CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
An attacker can cause a StackOverflowError in Apache Commons Configuration by adding a specific property, leading to application crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29131?
CVE-2024-29131 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Weakness: CWE-787
Which versions are affected by CVE-2024-29131?
2 open source packages ship an affected version, including org.apache.commons:commons-configuration2. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-configuration2 Maven | From 2.0 | 2.10.1 |
org.apache.commons:commons-configuration2 Maven | From 2.0 | 2.10.1 |
Products include Apache Commons Configuration, Fedoraproject Fedora, Netapp Ontap Tools, Netapp Snapcenter.
How do I fix CVE-2024-29131?
Upgrade org.apache.commons:commons-configuration2 to 2.10.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-29131 being exploited?
There is no known exploitation of CVE-2024-29131 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2020-1953 Remote code execution in Apache Commons Configuration
- CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults
- CVE-2025-46392 Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
- CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
- CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles
Sources
Also known as CLEANSTART-2026-OO91322, CLEANSTART-2026-PK50112, CLSA-2026-1789201689, CLSA-2026-1792011149, CLSA-2026-1793128350, DEBIAN-CVE-2024-29131 and 7 more.