CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles
Attackers can cause a denial of service via StackOverflowError by providing YAML input with cycles to Apache Commons Configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45205?
CVE-2026-45205 is a medium-severity denial of service vulnerability in Apache Commons Configuration, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uncontrolled Recursion vulnerability in Apache Commons.
When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0.
Users are recommended to upgrade to version 2.15.0, which fixes the issue.
Weakness: CWE-674
Which versions are affected by CVE-2026-45205?
2 open source packages ship an affected version, including org.apache.commons:commons-configuration2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.commons:commons-configuration2 Maven | From 2.2 | 2.15.0 |
org.apache.commons:commons-configuration2 Maven | From 2.2 | 2.15.0 |
Linux distribution packages (22)
apache-commons-configuration2 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.15.0-150200.5.14.1 |
apache-commons-configuration2 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 2.15.0-150200.5.11.1 |
apache-commons-text SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.15.0-150200.5.14.1 |
Products include Apache Commons Configuration.
How do I fix CVE-2026-45205?
Upgrade org.apache.commons:commons-configuration2 to 2.15.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45205 being exploited?
There is no known exploitation of CVE-2026-45205 in the wild and no public exploit code.
Other vulnerabilities in Apache Commons Configuration
- CVE-2020-1953 Remote code execution in Apache Commons Configuration
- CVE-2022-33980 Apache Commons Configuration insecure interpolation defaults
- CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
- CVE-2025-46392 Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
- CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
Sources
Also known as CLEANSTART-2026-EM62923, CLEANSTART-2026-JU98285, CLEANSTART-2026-SJ25007, CLEANSTART-2026-UG99660, CLSA-2026-1784682834, CLSA-2026-1788757933 and 37 more.