What’s Vulnerable › Vulnerabilities

CVE-2024-47554: Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-03 · updated 2026-06-17
• Weakness: CWE-400

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Affected products

• Apache Commons Io: from 2.0 before 2.14.0 — fixed in 2.14.0
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Bluexp: all versions
• NetApp E-Series Santricity Unified Manager: all versions
• NetApp E-Series Santricity Web Services Proxy: all versions
• NetApp Ontap Tools: 9, 10
• NetApp Santricity Storage Plugin: all versions
• NetApp SnapCenter: all versions
• Maven Commons-Io:Commons-Io: from 2.0 before 2.14.0; 2.0, 2.0.1, 2.1, 2.10.0, 2.11.0, 2.12.0 (+9) — fixed in 2.14.0

How to fix

Upgrade to a fixed version: Apache Commons Io 2.14.0; Maven Commons-Io:Commons-Io 2.14.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
• http://www.openwall.com/lists/oss-security/2024/10/03/2
• https://security.netapp.com/advisory/ntap-20250131-0010/

Get alerted when CVE-2024-47554 or the next vulnerability affects your stack