VulnSocial

CVE-2025-46392(apache / commons_configuration)

LOWCVSS 6.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • commons_configuration

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • 3 total mentions across 1 day

Affected systems

Vendors
apache
Products
commons_configuration

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-10-15: 310-15
Full discourse3 posts
  • GCP Weekly@gcpweekly

    This addresses the following vulnerability: CVE-2026-81870 N/A Security fixes for apigee-runtime. This addresses the following vulnerabilities: CVE-2025-46392 CVE-2026-19032 CVE-2026-49844 CVE-2026-68497 CVE-2026-83557 N/A Security fixes for apigee-synchronizer 10/16

    1000017
    1.8K followersView on X
  • GCP Weekly@gcpweekly

    CVE-2026-19032 CVE-2026-2332 CVE-2026-49844 CVE-2026-6790 CVE-2026-68497 CVE-2026-83557 N/A Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 CVE-2026-19032 CVE-2026-2332 CVE-2026-49844 8/16

    1000017
    1.8K followersView on X
  • GCP Weekly@gcpweekly

    CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 7/16

    1000014
    1.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachecommons_configuration---

Explore more

Back to dashboardapache CVEscommons_configuration vulnerabilities