CVE-2025-46392

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.

There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.

Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-463935.3In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the rendering of all channels i CVE-2025-463943.3In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.CVE-2025-463977.8A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.CVE-2025-463985.5In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation via read_objects func CVE-2025-463995.5A flaw was found in fig2dev. This vulnerability allows availability via local input manipulation via genge_itp_spline function.CVE-2025-46408.3Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers. Since version 1.14.0, PCL by default uses a zlib install CVE-2025-464005.5In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via rea CVE-2025-464047.5A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A special CVE-2025-464057.5When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to CVE-2025-464065.6A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one D CVE-2025-464078.8A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading CVE-2025-464089.8An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpC