VDB
GHSA-78wr-2p64-hpwj
GHSA-78wr-2p64-hpwj
PUBLISHED
CVSS 7.5 HIGH
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Record from GitHub Advisory Database · Published October 3, 2024
commons-io is fixed in 2.14.0 (Maven Central)
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| commons-io:commons-io | Maven Central | 2.14.0 |
| sonarqube-10 | Chainguard | 24.12.0.100206-r0 |
| py3.10-vllm-cuda-11.8 | Chainguard | 0.6.4-r0 |
| zookeeper-3.8 | Chainguard | 3.8.4.0-r6 |
| celeborn-0.5 | Wolfi | 0.5.4-r26 |
| sonarqube | Chainguard | 25.6.0.109173-r0 |
| celeborn-0.6 | Chainguard | 0.6.3-r7 |
| management-api-for-apache-cassandra-4.1 | Chainguard | 0.1.109-r0 |
| sonarqube | Wolfi | 25.6.0.109173-r0 |
| sonarqube-10 | Wolfi | 24.12.0.100206-r0 |
| zookeeper-3.9 | Wolfi | 3.9.2.0-r4 |
| opensearch-2 | Wolfi | 2.17.1-r1 |
40 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | sonarqube-10 | 0 |
| chainguard | py3.10-vllm-cuda-11.8 | 0 |
| chainguard | zookeeper-3.8 | 0 |
| wolfi | celeborn-0.5 | 0 |
| chainguard | sonarqube | 0 |
| chainguard | celeborn-0.6 | 0 |
| chainguard | management-api-for-apache-cassandra-4.1 | 0 |
| wolfi | sonarqube | 0 |
| wolfi | sonarqube-10 | 0 |
| wolfi | zookeeper-3.9 | 0 |
| wolfi | opensearch-2 | 0 |
| chainguard | kserve-modelmesh | 0 |
| chainguard | kserve | 0 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0 |
| wolfi | druid | 0, 0 |
| wolfi | wildfly | 0 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0 |
| Maven | commons-io:commons-io | 2.0 |
| chainguard | confluent-kafka | 0 |
| chainguard | logstash-8 | 0 |
…and 33 more
Timeline
- Oct 3, 2024 CVE Published
- Apr 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-78wr-2p64-hpwj
vulnetix vdb fixes GHSA-78wr-2p64-hpwjOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-78wr-2p64-hpwj/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart