How severe is CVE-2025-46392?

CVE-2025-46392 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2025-46392 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-46392?

CVE-2025-46392 affects Apache Commons Configuration. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-46392?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-46392 have an EU (EUVD) identifier?

Yes. CVE-2025-46392 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14160.

When was CVE-2025-46392 published?

CVE-2025-46392 was published on 2025-05-09 and last updated on 2026-06-17.

CVE-2025-46392

CVE-2025-46392 is a medium-severity vulnerability in Apache Commons Configuration with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-14160
Weakness: CWE-400
Affected product: Apache Commons Configuration
Published: 2025-05-09
Last modified: 2026-06-17

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

Frequently asked questions

What is CVE-2025-46392?: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.
How severe is CVE-2025-46392?: CVE-2025-46392 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2025-46392 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-46392?: CVE-2025-46392 affects Apache Commons Configuration. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-46392?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-46392 have an EU (EUVD) identifier?: Yes. CVE-2025-46392 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-14160.
When was CVE-2025-46392 published?: CVE-2025-46392 was published on 2025-05-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:commons_configuration:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Commons Configuration

CVE-2020-1953 — Critical (CVSS 10.0): Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation…
CVE-2022-33980 — Critical (CVSS 9.8): Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and…
CVE-2024-29131 — High (CVSS 7.3): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from…
CVE-2024-29133 — Medium (CVSS 5.4): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from…
CVE-2026-45205 — Medium (CVSS 5.3): Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons…

All CVEs affecting Apache Commons Configuration →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →