VulnerabilityAnalyzed

CVE-2024-47554

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

MEDIUM 4.3EPSS 1.31%

Does this matter?

Lower severity and a low EPSS score (1.31%). Track it; it rarely justifies an emergency change on its own.

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS: 1.31% probability · 69th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: apache/commons io · netapp/active iq unified manager · netapp/bluexp · netapp/e-series santricity unified manager · netapp/e-series santricity web services proxy · netapp/ontap tools · netapp/santricity storage plugin · netapp/snapcenter
Source: security@apache.org

References

https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/10/03/2Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0010/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.