Apache Commons Configuration — known CVE vulnerabilities

Every CVE whose affected-product data names Apache Commons Configuration, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2020-1953 — CVSS 10.0 (critical): Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the…
• CVE-2022-33980 — CVSS 9.8 (critical): Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard…
• CVE-2024-29131 — CVSS 7.3 (high): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1…
• CVE-2025-46392 — CVSS 6.5 (medium): Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons…
• CVE-2024-29133 — CVSS 5.4 (medium): Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1…
• CVE-2026-45205 — CVSS 5.3 (medium): Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a…