Apache Commons Configuration vulnerabilities

6 CVEs affecting Apache Commons Configuration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-45205, published 2026-05-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-33980, published 2022-07-06. Critical severity, CVSS 9.8. EPSS: 44.6% chance of exploitation in the next 30 days. Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix"…
CVE-2020-1953, published 2020-03-13. Critical severity, CVSS 10.0. EPSS: 6.3% chance of exploitation in the next 30 days. Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration…
CVE-2025-46392, published 2025-05-09. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when…
CVE-2024-29131, published 2024-03-21. High severity, CVSS 7.3. EPSS: 2.1% chance of exploitation in the next 30 days. Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which…
CVE-2024-29133, published 2024-03-21. Medium severity, CVSS 5.4. EPSS: 1.7% chance of exploitation in the next 30 days. Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which…
CVE-2026-45205, published 2026-05-14. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue…