CVE-2026-45205
MediumAdvisory
Published 14 May 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.005
- 39th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 59
- of 17,781 indexed, latest versions
- Container images
- 56
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Commons Configuration: StackOverflowError for YAML input with cycles
Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 56 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| commons-configuration2maven | 2.4, 2.5, 2.7, 2.8.0+6 more | 2.15.0 | 56 |
- OSV records
- GHSA-337m-mw94-2v6g
Charts affected
59 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| trinoopstty | 0.2.12 | 1 of 1See more | 1,158 |
| trinopresto-loadbalancer | 0.2.10 | 1 of 2See more | 2,264 |
| rada-platformrada-platform | 0.1.0 | 1 of 7See more | 21,211 |
| atlassian-confluencesomeblackmagic | 3.4.1 | 1 of 1See more | 13,605 |
| hazelcaststakaterVerified publisher | 1.0.2 | 1 of 1See more | 1,702 |
| sn-consolestreamnative | 1.13.0 | 1 of 1See more | 1,827 |
| hadoop-deploymenttejaswita-hadoop-helmchart | 1.0.0 | 1 of 1See more | 4,240 |
| hazelcastwenerme | 5.10.2 | 1 of 2See more | 2,634 |
| metabasewiremindVerified publisher | 2.27.5-wiremind0 | 1 of 1See more | 1,639 |
Container images carrying it
56 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 0116fb802786 | commons-configuration2 | 2.15.0 | 2 |
| apache/ | 7cdfd8deec92 | commons-configuration2 | 2.15.0 | 2 |
| hazelcast/ | 5dd5d31c7a06 | commons-configuration2 | 2.15.0 | 2 |
| library/ | 52d3dec8d455 | commons-configuration2 | 2.15.0 | 2 |
| library/ | 56a9453c4064 | commons-configuration2 | 2.15.0 | 2 |
| metabase/ | 9491ed11c901 | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 536358d7b17e | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 896fc7b18b1b | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 7752874e71d8 | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 3f2d14563495 | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 1fd3779f208e | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 900e2b88bd08 | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 5128775117aa | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 2a797804f08c | commons-configuration2 | 2.15.0 | 2 |
| ghcr.io/ | 096b8bcbbe45 | commons-configuration2 | 2.15.0 | 2 |
| 5200710/ | 092d3088a5fb | commons-configuration2 | 2.15.0 | 1 |
| aerospike/ | 781ba5213efd | commons-configuration2 | 2.15.0 | 1 |
| aerospike/ | f35739b97a46 | commons-configuration2 | 2.15.0 | 1 |
| ahmetfurkandemir/ | 142231a0b8b7 | commons-configuration2 | 2.15.0 | 1 |
| airsonicadvanced/ | f7cbafac2806 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 0305c26f19ed | commons-configuration2 | 2.15.0 | 1 |
| apache/ | bae523439ee3 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 0cef139b6bf1 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 80136ae753ee | commons-configuration2 | 2.15.0 | 1 |
| apache/ | af361b20bec0 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 090b7f87ec7f | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 63b8e3e40742 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | e66366e783f1 | commons-configuration2 | 2.15.0 | 1 |
| apache/ | 76c176e8a0e4 | commons-configuration2 | 2.15.0 | 1 |
| atlassian/ | 3b9222ab32ef | commons-configuration2 | 2.15.0 | 1 |
| ckan/ | ef8e5d3e6be1 | commons-configuration2 | 2.15.0 | 1 |
| gchq/ | c460bb587d6d | commons-configuration2 | 2.15.0 | 1 |
| gocd/ | 2da45cb09d57 | commons-configuration2 | 2.15.0 | 1 |
| gotson/ | 9b15ea6bfc30 | commons-configuration2 | 2.15.0 | 1 |
| graylog/ | 8a1f641cd7aa | commons-configuration2 | 2.15.0 | 1 |
| gridgain/ | 95018390077b | commons-configuration2 | 2.15.0 | 1 |
| hazelcast/ | 8fe26efde8e1 | commons-configuration2 | 2.15.0 | 1 |
| hazelcast/ | f086bf0ecb23 | commons-configuration2 | 2.15.0 | 1 |
| hazelcast/ | cf244da155eb | commons-configuration2 | 2.15.0 | 1 |
| library/ | 348e3f56faa2 | commons-configuration2 | 2.15.0 | 1 |
| library/ | 5ab4ab0358cf | commons-configuration2 | 2.15.0 | 1 |
| library/ | 8f01f7bb053e | commons-configuration2 | 2.15.0 | 1 |
| linuxserver/ | d286a7f55a59 | commons-configuration2 | 2.15.0 | 1 |
| metabase/ | 7807bc5cad17 | commons-configuration2 | 2.15.0 | 1 |
| odavid/ | e7ab3bbc948e | commons-configuration2 | 2.15.0 | 1 |
| opensearchproject/ | 57c25fa01d3c | commons-configuration2 | 2.15.0 | 1 |
| stardog/ | 2714e5c4b3c1 | commons-configuration2 | 2.15.0 | 1 |
| streamnative/ | 91e54375e154 | commons-configuration2 | 2.15.0 | 1 |
| trinodb/ | 1565e8cac299 | commons-configuration2 | 2.15.0 | 1 |
| trinodb/ | 38c6f24ab1a4 | commons-configuration2 | 2.15.0 | 1 |