CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles

May 14, 2026 (updated May 20, 2026)

Uncontrolled Recursion vulnerability in Apache Commons.

When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0.

Users are recommended to upgrade to version 2.15.0, which fixes the issue.

References

github.com/advisories/GHSA-337m-mw94-2v6g
github.com/apache/commons-configuration/pull/634
lists.apache.org/thread/q3q3j10ohcqhs6o0rg1v7kz6kk27vtkk
nvd.nist.gov/vuln/detail/CVE-2026-45205

Code Behaviors & Features

Detect and mitigate CVE-2026-45205 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →