CVE-2025-48924

Maven/org.apache.commons:commons-lang3 CVE-2025-48924: medium 6.5, EPSS 2.63%

Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs

Action: Upgrade org.apache.commons:commons-lang3 to 3.18.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-j288-q9x7-2f5v
• https://nvd.nist.gov/vuln/detail/CVE-2025-48924
• https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53
• https://github.com/apache/commons-lang
• https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1
• https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html
• https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html
• https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html
• https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html
• http://www.openwall.com/lists/oss-security/2025/07/11/1

CVE-2025-48924 · published 2025-07-11T15:31:37Z · modified 2026-09-10T03:50:26.176912270Z · JSON

Maven/commons-lang:commons-lang CVE-2025-48924: medium 6.5, EPSS 2.63%

Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-j288-q9x7-2f5v#Maven/commons-lang:commons-lang
• https://nvd.nist.gov/vuln/detail/CVE-2025-48924
• https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53
• https://github.com/apache/commons-lang
• https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1
• https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html
• https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html
• https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html
• https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html
• http://www.openwall.com/lists/oss-security/2025/07/11/1

CVE-2025-48924 · published 2025-07-11T15:31:37Z · modified 2026-09-10T03:50:26.176912270Z · JSON