CVE-2025-48924: 
Java vulnerability analysis and mitigation

An Uncontrolled Recursion vulnerability (CVE-2025-48924) was discovered in Apache Commons Lang, affecting versions from commons-lang:commons-lang 2.0 to 2.6 and org.apache.commons:commons-lang3 3.0 before 3.18.0. The vulnerability was disclosed on July 11, 2025, and was identified through OSS-Fuzz Issue 42522972 (NVD, OSS Security).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion) and involves the ClassUtils.getClass(...) methods. When presented with very long inputs, these methods can trigger a StackOverflowError. The vulnerability has received a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The primary impact of this vulnerability is potential service disruption. Since StackOverflowError is typically not handled by applications and libraries, its occurrence could cause the affected application to stop functioning. This creates a reliability issue that could affect system availability (OSS Security).

Users are strongly recommended to upgrade to Apache Commons Lang version 3.18.0, which contains the fix for this vulnerability. This is currently the only confirmed mitigation strategy (NVD, OSS Security).