CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
Attackers can cause a StackOverflowError and denial of service by providing a cyclical object tree to the ListDelimiterHandler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29133?
CVE-2024-29133 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 21 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Weakness: CWE-787
Which versions are affected by CVE-2024-29133?
2 open source packages ship an affected version, including org.apache.commons:commons-configuration2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-configuration2 Maven | From 2.0 | 2.10.1 |
org.apache.commons:commons-configuration2 Maven | From 2.0 | 2.10.1 |
Products include Apache Commons Configuration, Fedoraproject Fedora.
How do I fix CVE-2024-29133?
Upgrade org.apache.commons:commons-configuration2 to 2.10.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-29133 being exploited?
There is no known exploitation of CVE-2024-29133 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2020-1953 Remote code execution in Apache Commons Configuration
- CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults
- CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
- CVE-2025-46392 Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
- CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles
Sources
Also known as CLEANSTART-2026-GS71928, CLEANSTART-2026-ZE83350, DEBIAN-CVE-2024-29133, ECHO-7552-971a-4bb6, GHSA-9w38-p64v-xpmv, MINI-cq76-mphj-336c and 4 more.