CVE-2024-47554
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Reported by apache · Published October 3, 2024
Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| druid | Chainguard | 37.0.0-r56, 37.0.0-r14 |
| zookeeper-fips-3.9 | Chainguard | 3.9.2.0-r5 |
| logstash-jre-bcfips | Chainguard | 8.16.0-r0 |
| opensearch-2 | Wolfi | 2.17.1-r1 |
| sonarqube-10 | Chainguard | 24.12.0.100206-r0 |
| apache-commons-io-javadoc | Amazon Linux | 1:2.8.0-7.amzn2023.0.5 |
| celeborn-0.5 | Wolfi | 0.5.4-r26 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Commons IO | 2.0 |
| chainguard | druid | 0, 0 |
| chainguard | ranger | * |
| chainguard | zookeeper-fips-3.9 | 0 |
| chainguard | logstash-jre-bcfips | 0 |
| wolfi | opensearch-2 | 0 |
| chainguard | sonarqube-10 | 0 |
| amazon:2023 | apache-commons-io-javadoc | 0 |
| wolfi | celeborn-0.5 | 0 |
| wolfi | sonarqube | 0 |
| wolfi | zookeeper-3.9 | 0 |
| wolfi | confluent-common-docker | 0 |
| chainguard | kserve-modelmesh | 0 |
| chainguard | apache-nifi | 0 |
| Maven | commons-io:commons-io | 2.0 |
| wolfi | kserve-modelmesh | 0 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0 |
| chainguard | opensearch-2-jre-bcfips | 0 |
| chainguard | kserve | 0 |
| chainguard | wildfly | 0 |
…and 40 more
Timeline
- Oct 3, 2024 CVE Published
- Oct 4, 2024 EPSS Score (30 in total, the first dated here)
- Oct 5, 2024 Coalition ESS Score (21 in total, the first dated here)
- Mar 17, 2026 Security Advisory (17 in total, the first dated here)
- Oct 13, 2026 Distribution Patch (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-47554
vulnetix vdb fixes CVE-2024-47554Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-47554/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47554 advisory
- https://github.com/advisories/GHSA-78wr-2p64-hpwj advisory
- https://github.com/apache/commons-io url
- https://security.netapp.com/advisory/ntap-20250131-0010 advisory
- http://www.openwall.com/lists/oss-security/2024/10/03/2 url
- https://security.netapp.com/advisory/ntap-20250131-0010/ url