org.apache.commons:commons-configuration2 (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.commons:commons-configuration2, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2020-1953 — CVSS 10.0 (critical): Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the…
• CVE-2022-33980 — CVSS 9.8 (critical): Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard…
• CVE-2024-29131 — CVSS 7.3 (high): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1…
• CVE-2024-29133 — CVSS 5.4 (medium): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1…
• CVE-2026-45205 — CVSS 5.3 (medium): Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a…