CVE-2025-48924
MediumAdvisory
Published 11 Jul 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.023
- 82nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 629
- of 17,790 indexed, latest versions
- Container images
- 678
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
Carried by container images the latest versions of 629 of 17,790 indexed charts deploy, on 678 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| commons-lang3maven | 3.0, 3.1, 3.2, 3.2.1+17 more | 3.18.0 | 593 |
| commons-langmaven | 2.1, 2.2, 2.4, 2.5+1 more | no fix listed | 307 |
| libcommons-lang3-javadeb | 3.8-2 | 3.8-2ubuntu0.1~esm1 | 1 |
- OSV records
- GHSA-j288-q9x7-2f5vUBUNTU-CVE-2025-48924
- Also known as
- USN-8364-1
Charts affected
629 by stars
Container images carrying it
678 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| seldonio/ | ba81b17f00eb | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| seldonio/ | eea0d3f578ca | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| seldonio/ | 29e362bb1ba2 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| sismics/ | f4b0ef019cf1 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| slamdev/ | b4b029c9b15f | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| slamdev/ | 3ca20c184c55 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| snappydatainc/ | fd4b2070466f | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| snowplow/ | 5a38033f07c1 | commons-lang3 | 3.18.0 | 1 |
| snowplow/ | 41d318841516 | commons-lang3 | 3.18.0 | 1 |
| soldevelo/ | cfdc08c2f577 | commons-lang3 | 3.18.0 | 1 |
| someblackmagic/ | 0d63ba37a560 | commons-lang3 | 3.18.0 | 1 |
| sonatype/ | 6bc88b51d4d7 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| sonatype/ | 4bd975493104 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| sonatype/ | 586060431b64 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| sslhep/ | 9e80af083079 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| stain/ | b1d0c96f19ad | commons-lang3 | 3.18.0 | 1 |
| stardog/ | 2714e5c4b3c1 | commons-lang | no fix listed | 1 |
| svtechnmaa/ | 6e368ace0977 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| sysnet4admin/ | bc25b152d88e | commons-lang3 | 3.18.0 | 1 |
| thehiveproject/ | f4bc64fb8844 | commons-lang | no fix listed | 1 |
| thelastpickle/ | 9c53996c457d | commons-lang3 | 3.18.0 | 1 |
| thingsboard/ | bd45a09d85d9 | commons-lang3 | 3.18.0 | 1 |
| thingsboard/ | a06f53c5e2da | commons-lang3 | 3.18.0 | 1 |
| thingsboard/ | 030f316ce301 | commons-lang3 | 3.18.0 | 1 |
| thingsboard/ | 645f43b688f7 | commons-lang3 | 3.18.0 | 1 |
| thingsboard/ | f40a542832c4 | commons-lang3 | 3.18.0 | 1 |
| tock/ | 080cb6b08d5b | commons-lang3 | 3.18.0 | 1 |
| tock/ | c04ffe67b977 | commons-lang3 | 3.18.0 | 1 |
| traccar/ | 621c8d6d46fd | commons-lang3 | 3.18.0 | 1 |
| treskon/ | 88e813f22347 | commons-lang3 | 3.18.0 | 1 |
| trinodb/ | 1565e8cac299 | commons-lang | no fix listed | 1 |
| trinodb/ | 38c6f24ab1a4 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| trinodb/ | 5b5e0a97f599 | commons-lang | no fix listed | 1 |
| trinodb/ | 6af989b0846d | commons-lang | no fix listed | 1 |
| trinodb/ | ee80ab5eeab2 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| vespaengine/ | 69b160f58211 | commons-lang3 | 3.18.0 | 1 |
| viniciusfcf/ | bba8ee1b5cd5 | commons-lang3 | 3.18.0 | 1 |
| vitalii1992/ | 0e694d94551d | commons-lang | no fix listed | 1 |
| vitalii1992/ | 8e798836ecea | commons-lang | no fix listed | 1 |
| vitalii1992/ | aabe6ac39356 | commons-lang | no fix listed | 1 |
| vitalii1992/ | 07c4a8833ce4 | commons-lang | no fix listed | 1 |
| vitalii1992/ | 44d2d6e00ab3 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| vlebediantsev/ | 10393a89b4a8 | commons-lang3 | 3.18.0 | 1 |
| vlebediantsev/ | df8bf38c535b | commons-lang3 | 3.18.0 | 1 |
| vlebediantsev/ | 427af418b75e | commons-lang3 | 3.18.0 | 1 |
| vlebediantsev/ | 9319437f3c8f | commons-lang3 | 3.18.0 | 1 |
| voltha/ | e038acb950d3 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| vrijbrp/ | bc85c89530b9 | commons-lang3 | 3.18.0 | 1 |
| vrijbrp/ | c6603cb829ea | commons-lang3 | 3.18.0 | 1 |
| vrijbrp/ | 5c770c2ae48c | commons-lang3 | 3.18.0 | 1 |