CVE-2025-46392

mediumEPSS 0.021 · 82 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.12% (82nd) EPSS

CVSS 6.5 · medium

Is it mine?

22 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-20

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-400US

affected products (22)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Apache Commons Configuration <2.0.0all versionscert_bundDE
Dell Secure Connect Gateway <5.36.00.16all versionscert_bundDE
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:traditional
IBM Tivoli Network Manager IP Edition <4.2 Fix Pack 23all versionscert_bundDE
NetApp ActiveIQ Unified Managerall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:-
SAS Institute Base SAS <9.4M9 (TS1M9)all versionscert_bundDE
Apache Commons≤ Configuration <2.0.0cert_bundDE
Dell Networker≤ REST API <19.14cert_bundDE
Dell Networker≤ AUTHC <19.14cert_bundDE
Dell Networker≤ File-Level Recovery <19.14cert_bundDE
Dell Networker≤ Management Console <19.14cert_bundDE
Dell Networker≤ Management Web UI <19.14cert_bundDE
Dell Networker≤ vCenter User Interface <19.14cert_bundDE
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
IBM Tivoli Network Manager≤ IP Edition <4.2 Fix Pack 23cert_bundDE
SAS Institute Base SAS< 9.4M9 (TS1M9)cert_bundDE
Apache Software Foundation Apache Commons Configuration1 → 2.0.0enisa_euvdEU
Apache Software Foundation Commons Configuration1.0 → 2.0fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU

showing 20 of 22

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0997Apache Commons Configuration: Schwachstelle ermöglicht Denial of ServiceDeutsch2025-05-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons Configuration ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2026-0351Dell NetWorker (Third Party Components): Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.
WID-SEC-W-2026-1203Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-1204Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-pvp8-3xj6-8c6xApache Commons Configuration Uncontrolled Resource Consumption2025-05-09ghsa · osvUS
Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenarios where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2025-05-09modified 2026-06-17

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan