CVE-2024-47554 Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

Medium 4.3 Published 3 Oct 2024 Updated 31 Jan 2025

Attackers can cause excessive CPU consumption and denial of service by sending malicious input to the XmlStreamReader class in Apache Commons IO.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-47554?

CVE-2024-47554 is a medium-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 3 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Weakness: CWE-400

Which versions are affected by CVE-2024-47554?

2 open source packages ship an affected version, including commons-io:commons-io. It affects 8 products.

Package	Affected	Fixed in
`commons-io:commons-io` Maven	From `2.0`	`2.14.0`
`commons-io:commons-io` Maven	From `2.0`	`2.14.0`

Linux distribution packages (20)

`apache-commons-io` SUSE:Enterprise Storage 7.1	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.17.0-11.3.1`
`apache-commons-io` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server 15 SP5-LTSS	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.17.0-11.3.1`
`apache-commons-io` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`2.17.0-11.3.1`
`apache-commons-io` SUSE:Manager Proxy 4.3	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` SUSE:Manager Server 4.3	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` openSUSE:Leap 15.6	All versions	`2.18.0-150200.3.15.1`
`apache-commons-io` openSUSE:Tumbleweed	All versions	`2.17.0-2.1`

Products include Apache Commons Io, Netapp Active Iq Unified Manager, Netapp Bluexp, Netapp E-Series Santricity Unified Manager, Netapp E-Series Santricity Web Services Proxy, Netapp Ontap Tools and 2 more.

How do I fix CVE-2024-47554?

Upgrade commons-io:commons-io to 2.14.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-47554 being exploited?

There is no known exploitation of CVE-2024-47554 in the wild and no public exploit code.

CVE-2021-29425 Possible limited path traversal vulnerabily in Apache Commons IO Medium 6.5

All Netapp Active Iq Unified Manager vulnerabilities

Sources

Also known as AZL-50019, AZL-50031, CLEANSTART-2026-FM94939, CLEANSTART-2026-PL91023, CLEANSTART-2026-QI10138, CLEANSTART-2026-UQ49290 and 36 more.