CVE-2025-48924
MediumAdvisory
Published 11 Jul 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.023
- 82nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 631
- of 17,781 indexed, latest versions
- Container images
- 684
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
Carried by container images the latest versions of 631 of 17,781 indexed charts deploy, on 684 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| commons-lang3maven | 3.0, 3.1, 3.2, 3.2.1+17 more | 3.18.0 | 599 |
| commons-langmaven | 2.1, 2.2, 2.4, 2.5+1 more | no fix listed | 307 |
| libcommons-lang3-javadeb | 3.8-2 | 3.8-2ubuntu0.1~esm1 | 1 |
- OSV records
- GHSA-j288-q9x7-2f5vUBUNTU-CVE-2025-48924
- Also known as
- USN-8364-1
Charts affected
631 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| jenkinsjenkinsciOfficialVerified publisher | 5.9.58 | 1 of 2See more | 2,665 |
| sonarqubesonarqubeVerified publisher | 10.0.0+521 | 1 of 3See more | 6,556 |
| keycloakcodecentricVerified publisher | 18.10.0 | 1 of 3See more | 7,713 |
| jiraatlassian-data-centerVerified publisher | 2.0.15 | 1 of 2See more | 1,490 |
| trinotrino | 1.42.2 | 1 of 1See more | 1,309 |
| graylogkong-zVerified publisher | 3.0.32 | 1 of 5See more | 2,699 |
| milvusmilvus | 4.0.31 | 1 of 5See more | 32,259 |
| nacosygqygq2Verified publisher | 2.1.10 | 1 of 4See more | 4,983 |
| guacamoleberyju-org | 1.4.2 | 1 of 3See more | 3,606 |
| dependency-trackevryfs-ossVerified publisher | 1.5.5 | 1 of 3See more | 2,503 |
| gotenbergmaikumoriVerified publisher | 1.25.0 | 1 of 1See more | 9,683 |
| glasskube-operatorglasskubeOfficialVerified publisher | 0.12.2 | 1 of 3See more | 11,933 |
| milvusmilvus-helm | 5.0.27 | 1 of 4See more | 10,670 |
| rocketmqrocketmq | 12.6.0 | 2 of 2See more | 6,328 |
| apicurio-registryapicurio-registry-helmVerified publisher | 3.8.0 | 1 of 2See more | 6,675 |
| bitbucketatlassian-data-centerVerified publisher | 2.0.15 | 1 of 1See more | 1,444 |
| apim3graviteeioVerified publisher | 4.12.19 | 2 of 4See more | 4,806 |
| polarisapache-polarisOfficialVerified publisher | 1.3.0-incubating | 1 of 1See more | 455 |
| cloudbeaveravistoVerified publisher | 1.1.7 | 1 of 1See more | 1,710 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 10,775 |
| druiddruid-helmVerified publisher | 37.0.2 | 1 of 3See more | 3,812 |
| hivemq-operatorhivemqOfficialVerified publisher | 0.11.62 | 1 of 2See more | 7,857 |
| kafkakubelauncherVerified publisher | 0.1.26 | 1 of 1See more | 1,360 |
| neo4jneo4j-helm | 4.3.2-1 | 1 of 1See more | 2,640 |
| sonarqube-ltssonarqubeVerified publisher | 1.0.16+98 | 1 of 4See more | 4,099 |
| metabasedeliveryheroVerified publisher | 0.14.4 | 1 of 1See more | 2,572 |
| guacamoledmunozv04Verified publisher | 0.3.4 | 1 of 2See more | 3,606 |
| hdfsgaffer | 2.2.1 | 1 of 2See more | 5,357 |
| grayloggroundhog2k | 0.13.10 | 1 of 1See more | 1,074 |
| kafkakafka | 18.0.1 | 1 of 1See more | 3,395 |
| temporallemontechVerified publisher | 0.37.0 | 1 of 13See more | 14,893 |
| microcksmicrocksOfficialVerified publisher | 0.8.0-helm-3.kube-1.17 | 1 of 5See more | 10,732 |
| sparkmicrosoft | 1.0.4 | 2 of 3See more | 13,738 |
| solrpreferred-aiVerified publisher | 3.2.0 | 1 of 3See more | 6,048 |
| puppetserverpuppetserver | 9.5.2 | 2 of 5See more | 14,184 |
| unifiunifiVerified publisher | 1.16.0 | 1 of 1See more | 7,268 |
| elasticsearch-clusterwiremindVerified publisher | 4.5.2 | 1 of 2See more | 2,283 |
| hadoopbigdata-chartsVerified publisher | 1.0.1 | 1 of 2See more | 12,111 |
| grayloggraylog2OfficialVerified publisher | 2.0.0 | 1 of 2See more | 1,500 |
| jira-softwaremoxVerified publisher | 2.7.1 | 1 of 3See more | 8,636 |
| nexus-iq-serversonatypeVerified publisher | 207.1.0 | 1 of 1See more | 38 |
| thehivestrangebee-helmOfficialVerified publisher | 1.0.6 | 3 of 7See more | 16,210 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 6,168 |
| druidwiremindVerified publisher | 1.22.1 | 1 of 3See more | 7,930 |
| seafiledatamateVerified publisher | 0.6.0 | 1 of 6See more | 27,267 |
| geonode-k8sgeonode-k8sVerified publisher | 2.0.0 | 1 of 10See more | 13,953 |
| guacamolehalkeye | 0.2.1 | 1 of 3See more | 4,839 |
| hertzbeathertzbeatOfficialVerified publisher | 1.8.1 | 2 of 4See more | 14,000 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 2 of 6See more | 10,530 |
| musicocielmusicocielVerified publisher | 0.0.0 | 1 of 3See more | 4,406 |
Container images carrying it
684 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| huertaslopez/ | e2c18bd65472 | commons-lang3 | 3.18.0 | 1 |
| hugohg34/ | 171f61e8d7e2 | commons-lang3 | 3.18.0 | 1 |
| iamdorsah/ | db83a0254d81 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | ce9d2a564273 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | a6748792da26 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | 5441dba2fa00 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | e31ff09e8aad | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | 7e4dc1e27cdf | commons-lang3 | 3.18.0 | 1 |
| ibmcom/ | b558f2b444ae | commons-lang3 | 3.18.0 | 1 |
| ibmcom/ | ab3fd1fdfa18 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| ibmcom/ | ed5505e5c7ec | commons-lang3 | 3.18.0 | 1 |
| ibmcom/ | e17bdccc5030 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| intelloop/ | 4c61bc3dd3f8 | commons-lang3 | 3.18.0 | 1 |
| jacobalberty/ | 4a3616625dda | commons-lang3 | 3.18.0 | 1 |
| jacobalberty/ | b3edc809a3ff | commons-lang3 | 3.18.0 | 1 |
| jacobalberty/ | c409924e2463 | commons-lang | no fix listed | 1 |
| javaaurelio/ | 8541a3cd021a | commons-lang3 | 3.18.0 | 1 |
| jenkinsci/ | a1f33f004659 | commons-lang | no fix listed | 1 |
| jenkins/ | 95313257a8cd | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| jenkins/ | de4fea113221 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| jhipster/ | 7184525acd4d | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| jingking/ | 43e74ab234e1 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| just1not2/ | 8a2305192dec | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| kafkace/ | 7adc206bf5a4 | commons-lang3 | 3.18.0 | 1 |
| kafkakraft/ | 062d697db7e5 | commons-lang3 | 3.18.0 | 1 |
| kafkakraft/ | f261ad288fce | commons-lang3 | 3.18.0 | 1 |
| kafkakraft/ | 2e4b593b878b | commons-lang3 | 3.18.0 | 1 |
| keyfactor/ | 798fbbe00283 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| kimb88/ | 0639155241cb | commons-lang | no fix listed | 1 |
| kubebb/ | 4d062f20309c | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| kubebb/ | a3879931dfa1 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| kvalitetsit/ | f0af0ba589af | commons-lang3 | 3.18.0 | 1 |
| kyso/ | 68091eace89c | commons-lang | no fix listed | 1 |
| ladeit/ | 962b665ffe82 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| library/ | 98531a31f213 | commons-lang3 | 3.18.0 | 1 |
| library/ | b095ff3248c6 | commons-lang3 | 3.18.0 | 1 |
| library/ | cb079c0d7a57 | commons-lang3 | 3.18.0 | 1 |
| library/ | 2817ad50b5c5 | commons-lang3 | 3.18.0 | 1 |
| library/ | c7984a05e15b | commons-lang | no fix listed | 1 |
| library/ | 2cc40b15dff8 | commons-lang3 | 3.18.0 | 1 |
| library/ | 310b9fc03b06 | commons-lang3 | 3.18.0 | 1 |
| library/ | 8d09295845fe | commons-lang3 | 3.18.0 | 1 |
| library/ | 9656a9ca03f8 | commons-lang3 | 3.18.0 | 1 |
| library/ | 1fe4fb22a2a5 | commons-lang3 | 3.18.0 | 1 |
| library/ | 348e3f56faa2 | commons-lang3 | 3.18.0 | 1 |
| library/ | 8f01f7bb053e | commons-lang3 | 3.18.0 | 1 |
| library/ | a1ba477fa412 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| library/ | d4eaa8484246 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| library/ | d124efd81fbb | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |
| library/ | 0842dcd4c8f8 | commons-lang commons-lang3 | no fix listed 3.18.0 | 1 |