CVE-2025-48924
MediumAdvisory
Published 11 Jul 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.023
- 82nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 634
- of 17,787 indexed, latest versions
- Container images
- 686
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
Carried by container images the latest versions of 634 of 17,787 indexed charts deploy, on 686 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| commons-lang3maven | 3.0, 3.1, 3.2, 3.2.1+17 more | 3.18.0 | 600 |
| commons-langmaven | 2.1, 2.2, 2.4, 2.5+1 more | no fix listed | 310 |
| libcommons-lang3-javadeb | 3.8-2 | 3.8-2ubuntu0.1~esm1 | 1 |
- OSV records
- GHSA-j288-q9x7-2f5vUBUNTU-CVE-2025-48924
- Also known as
- USN-8364-1
Charts affected
634 by stars
Container images carrying it
686 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| airbyte/ | d42813fcc191 | commons-lang3 | 3.18.0 | 1 |
| airbyte/ | caf4f551c546 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| airbyte/ | d97b67a1346d | commons-lang3 | 3.18.0 | 1 |
| airbyte/ | 8060b88b29c8 | commons-lang3 | 3.18.0 | 1 |
| airsonicadvanced/ | f7cbafac2806 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| aktosecurity/ | bcd7382c9c1b | commons-lang3 | 3.18.0 | 1 |
| aktosecurity/ | 213aded7adc5 | commons-lang3 | 3.18.0 | 1 |
| aktosecurity/ | 46ed5bcb04b2 | commons-lang3 | 3.18.0 | 1 |
| aktosecurity/ | 498e3e35ecc2 | commons-lang3 | 3.18.0 | 1 |
| aktosecurity/ | 274042ed7a53 | commons-lang3 | 3.18.0 | 1 |
| alfresco/ | 5472f88d9b0b | commons-lang3 | 3.18.0 | 1 |
| amazon/ | 6df71eb04639 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| andrianrf/ | 6036614803d4 | commons-lang3 | 3.18.0 | 1 |
| andrianrf/ | ba560086ce15 | commons-lang3 | 3.18.0 | 1 |
| andrianrf/ | 7da47f525c7d | commons-lang3 | 3.18.0 | 1 |
| anguda/ | c435285fc241 | commons-lang3 | 3.18.0 | 1 |
| apache/ | bae523439ee3 | commons-lang3 | 3.18.0 | 1 |
| apache/ | a7d9970c148f | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 3bb13d14f64a | commons-lang3 | 3.18.0 | 1 |
| apache/ | 1f96558fd292 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 0cef139b6bf1 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 80136ae753ee | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | af361b20bec0 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 75d48a62748f | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | a2bab1be574c | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apacheignite/ | d7deab68b8fa | commons-lang | no fix listed | 1 |
| apache/ | 8647309f95d1 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | afa47bf1692a | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | fbc7d7c428e3 | commons-lang3 | 3.18.0 | 1 |
| apache/ | 090b7f87ec7f | commons-lang3 | 3.18.0 | 1 |
| apache/ | 63b8e3e40742 | commons-lang3 | 3.18.0 | 1 |
| apache/ | 974efa2f21da | commons-lang3 | 3.18.0 | 1 |
| apachepinot/ | 0018bb04ced7 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | e66366e783f1 | commons-lang | no fix listed | 1 |
| apachepulsar/ | 16f9fdab3fa6 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apachepulsar/ | 4db6ff0b4045 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apachepulsar/ | 9c9947de139d | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apachepulsar/ | d056c89b7131 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apachepulsar/ | d538416d5afe | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 76c176e8a0e4 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 434d8398f996 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 5ac2a4e0f627 | commons-lang3 | 3.18.0 | 1 |
| apache/ | c8fb51195444 | commons-lang3 | 3.18.0 | 1 |
| apacherocketmq/ | 24799aff6cf8 | commons-lang3 | 3.18.0 | 1 |
| apache/ | e2be712fc4f4 | commons-lang3 | 3.18.0 | 1 |
| apache/ | 1bd5756f6273 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | 133d35d2c263 | commons-lang3 | 3.18.0 | 1 |
| apache/ | 641237e0299b | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| apache/ | b4ec8c18d079 | commons-lang3 | 3.18.0 | 1 |