CVE-2025-48924 Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

What is CVE-2025-48924?

CVE-2025-48924 is a medium-severity denial of service vulnerability in Apache Commons Lang, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Weakness: CWE-674

Which versions are affected by CVE-2025-48924?

4 open source packages ship an affected version, including org.apache.commons:commons-lang3 and commons-lang:commons-lang. It affects 1 product.

Products include Apache Commons Lang.

How do I fix CVE-2025-48924?

Upgrade org.apache.commons:commons-lang3 to 3.18.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-48924 being exploited?

There is no known exploitation of CVE-2025-48924 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-65144, AZL-65181, CLEANSTART-2026-CK84592, CLEANSTART-2026-CR94528, CLEANSTART-2026-EA81114, CLEANSTART-2026-IF64131 and 107 more.