CVE-2025-46392: Apache Commons Configuration Uncontrolled Resource Consumption
6.5
Basic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
commons-configuration:commons-configuration | maven | <= 1.10 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability described (GHSA-pvp8-3xj6-8c6x, CVE-2025-46392) is an 'Uncontrolled Resource Consumption' issue in Apache Commons Configuration
1.x. According to the advisory, 'The Apache Commons Configuration team does not intend to fix these issues in 1.x.' Instead, users are advised to upgrade to version 2.x. Since there are no security patches for this specific vulnerability in the 1.x version range, it is not possible to identify vulnerable functions based on patch analysis as per the task requirements. The commit information provided is empty. The referenced CVEs (CVE-2024-29131, CVE-2024-29133) pertain to Apache Commons Configuration
2.x and address 'Out-of-bounds Write' vulnerabilities, which are different from the described 1.x issue and its resolution (or lack thereof via patching). Therefore, without specific patches for the 1.x 'Uncontrolled Resource Consumption' vulnerability, no functions can be identified through the requested patch analysis methodology.