Threats Tagged 'cve-2025-48924'

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.15 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.14, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.15 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543) * org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files (CVE-2025-23184) * undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues: Changes in apache-commons-lang3: Update to 3.20.0 * New features: + Add SystemProperties.getPath(String, Supplier<Path>) + Add JavaVersion.JAVA_25 + Add JavaVersion.JAVA_26 + Add SystemUtils.IS_JAVA_25 + Add SystemUtils.IS_JAVA_26 + Add MutablePair.ofNonNull(Map.Entry) + Add TimedSemaphore.builder(), Builder, and deprecate constructors + LANG-1504: Adding labels and history to split StopWatch * Fixed Bugs: + Optimize ObjectToStringComparator.compare() method + [javadoc] Improve StringUtils Javadoc + Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum() + Use accessors in ToStringStyle so subclasses can effectively override them + 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException' + Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages + Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference() + LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console + LANG-1792: TypeUtils.toString() skips angle brackets for Class type + Mention JDK 25 LTS as a tested version in the release notes * Changes: + Bump org.apache.commons:commons-parent from 88 to 92 - Update to 3.19.0 * New features: + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH + Add SystemUtils.IS_OS_NETWARE + Add MethodUtils.getAccessibleMethod(Class, Method) + Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs + Add StringUtils.indexOfAny(CharSequence, int, char...) + Add ConcurrentException.ConcurrentException(String) + Add DateUtils.toLocalDateTime(Date[, TimeZone]) + Add DateUtils.toOffsetDateTime(Date[, TimeZone]) + Add DateUtils.toZonedDateTime(Date[, TimeZone]) + Add ByteConsumer + Add ByteSupplier + Add FailableByteConsumer + Add FailableByteSupplier + LANG-1784: Add Functions methods for null-safe mapping and chaining + LANG-1784: Add Failable methods for null-safe mapping and chaining + Add DoubleRange.fit(double) + Add IntegerRange.fit(int) + Add LongRange.fit(long) + Add DurationUtils.get(String, TemporalUnit, long) + Add DurationUtils.getMillis(String, long) + Add DurationUtils.getSeconds(String, long) + Add SystemProperties.getBoolean(Class, String, boolean) + Add SystemProperties.getInt(Class, String, int) + Add SystemProperties.getLong(Class, String, long) * Fixed Bugs: + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods + MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types + Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods + MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass + AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException + LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException + LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values + MethodUtils cannot find or invoke vararg methods of interface types + MethodUtils cannot find or invoke vararg methods when widening primitive types following the JLS 5.1.2. Widening Primitive Conversion + LANG-1597: Invocation fails because matching varargs method found but then discarded + Don't check accessibility twice in MemberUtils .setAccessibleWorkaround(T) + LANG-1774: Improve handling of ClassUtils .getShortCanonicalName() for invalid input + LANG-1720: Improve Javadocs for Conversion + Fix CalendarUtils.toLocalDate() Javadoc return type description + Fix the method name in Javadoc examples for CharUtils.isHex() + Deprecate NumberUtils.compare(byte, byte) in favor of Byte.compare(byte, byte) + Deprecate NumberUtils.compare(int, int) in favor of Integer.compare(int, int) + Deprecate NumberUtils.compare(long, long) in favor of Long.compare(long, long) + Deprecate NumberUtils.compare(short, short) in favor of Short.compare(short, short) + Deprecate obsolete sys

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues: Changes in apache-commons-lang3: Update to 3.20.0 * New features: + Add SystemProperties.getPath(String, Supplier<Path>) + Add JavaVersion.JAVA_25 + Add JavaVersion.JAVA_26 + Add SystemUtils.IS_JAVA_25 + Add SystemUtils.IS_JAVA_26 + Add MutablePair.ofNonNull(Map.Entry) + Add TimedSemaphore.builder(), Builder, and deprecate constructors + LANG-1504: Adding labels and history to split StopWatch * Fixed Bugs: + Optimize ObjectToStringComparator.compare() method + [javadoc] Improve StringUtils Javadoc + Fix internal inverted logic in private isEnum() method and correct its usage in getFirstEnum() + Use accessors in ToStringStyle so subclasses can effectively override them + 'LocaleUtils.toLocale(String)' for a 2 letter country code now returns a value instead of throwing an 'IllegalArgumentException' + Fix typo in StringUtils.trunctate() IllegalArgumentException message and test assertion messages + Fix test fixture in ReflectionDiffBuilderTest.testTransientFieldDifference() + LANG-1789: NullPointerException when generating NoSuchMethodException in MethodUtils + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE WARNINGs to the console + LANG-1792: TypeUtils.toString() skips angle brackets for Class type + Mention JDK 25 LTS as a tested version in the release notes * Changes: + Bump org.apache.commons:commons-parent from 88 to 92 - Update to 3.19.0 * New features: + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH + Add SystemUtils.IS_OS_NETWARE + Add MethodUtils.getAccessibleMethod(Class, Method) + Add documentation to site for CVE-2025-48924 ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs + Add StringUtils.indexOfAny(CharSequence, int, char...) + Add ConcurrentException.ConcurrentException(String) + Add DateUtils.toLocalDateTime(Date[, TimeZone]) + Add DateUtils.toOffsetDateTime(Date[, TimeZone]) + Add DateUtils.toZonedDateTime(Date[, TimeZone]) + Add ByteConsumer + Add ByteSupplier + Add FailableByteConsumer + Add FailableByteSupplier + LANG-1784: Add Functions methods for null-safe mapping and chaining + LANG-1784: Add Failable methods for null-safe mapping and chaining + Add DoubleRange.fit(double) + Add IntegerRange.fit(int) + Add LongRange.fit(long) + Add DurationUtils.get(String, TemporalUnit, long) + Add DurationUtils.getMillis(String, long) + Add DurationUtils.getSeconds(String, long) + Add SystemProperties.getBoolean(Class, String, boolean) + Add SystemProperties.getInt(Class, String, int) + Add SystemProperties.getLong(Class, String, long) * Fixed Bugs: + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the hierarchy of methods + MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now returns null instead of throwing a NullPointerException, as it does for other exception types + Reduce spurious failures in ArrayUtilsTest methods that test ArrayUtils.shuffle() methods + MethodUtils cannot find or invoke a public method on a public class implemented in its package-private superclass + AtomicSafeInitializer.get() can spin internally if the FailableSupplier given to AbstractConcurrentInitializer .AbstractBuilder.setInitializer(FailableSupplier) throws a RuntimeException + LANG-1783: WordUtils.containsAllWords?() may throw PatternSyntaxException + LANG-1782: MethodUtils cannot find or invoke vararg methods without providing vararg types or values + MethodUtils cannot find or invoke vararg methods of interface types + MethodUtils cannot find or invoke vararg methods when widening primitive types following the JLS 5.1.2. Widening Primitive Conversion + LANG-1597: Invocation fails because matching varargs method found but then discarded + Don't check accessibility twice in MemberUtils .setAccessibleWorkaround(T) + LANG-1774: Improve handling of ClassUtils .getShortCanonicalName() for invalid input + LANG-1720: Improve Javadocs for Conversion + Fix CalendarUtils.toLocalDate() Javadoc return type description + Fix the method name in Javadoc examples for CharUtils.isHex() + Deprecate NumberUtils.compare(byte, byte) in favor of Byte.compare(byte, byte) + Deprecate NumberUtils.compare(int, int) in favor of Integer.compare(int, int) + Deprecate NumberUtils.compare(long, long) in favor of Long.compare(long, long) + Deprecate NumberUtils.compare(short, short) in favor of Short.compare(short, short) + Deprecate obsolete sys

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 3.1.0 serves as a replacement for Red Hat Streams for Apache Kafka 3.0.1, and includes security and bug fixes, and enhancements. Security Fix(es): * Apache Kafka, Drain Cleaner, Bridge, Cruise Conreol, Proxy, Console: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack"(CVE-2025-58057)" * Apache Kafka, Proxy: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions"(CVE-2025-58056)" * Apache Kafka, Bridge, Drain Cleaner, Cruise Control, Console: Netty MadeYouReset HTTP/2 DDoS Vulnerability ("CVE-2025-55163") * Apache Kafka: org.apache.commons:commons-lang3 : Uncontrolled Recursion("CVE-2025-48924") * Drain Cleaner: io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout("CVE-2025-1634") * Drain Cleaner, Console: Data leak vulnerability in io.quarkus:quarkus-vertx package ("CVE-2025-49574") * Cruise Control: org.apache.kafka/kafka_2.13: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption (" CVE-2024-56128") * Cruise Control: org.apache.kafka: Kafka Client Arbitrary File Read SSRF("CVE-2025-27817") * Cruise Control: Kafka Clients Vulnerabiliy("CVE-2025-27819") * Cruise Control: Kafka Clients Vulnerabiliy("CVE-2025-27818") * Cruise Control, Console: io.vertx/vertx-core: Eclipse Vert.x Access Control Flaw ("CVE-2025-11965") * Cruise Control, Console: Vertx - Cross-site scripting (XSS) vulnerability ("CVE-2025-11966")

CVE-2025-48924 is an uncontrolled recursion vulnerability in Apache Commons Lang affecting versions 2.0 through 2.6 and 3.0 through before 3.18.0. The issue occurs in the ClassUtils.getClass(... ) method, which can throw a StackOverflowError when processing very long inputs. Since StackOverflowError is typically not caught by applications, this can cause the affected application to crash or stop unexpectedly.