Apache Commons Configuration Uncontrolled Recursion Vulnerability in YAML Processing

A vulnerability allowing uncontrolled recursion has been identified in Apache Commons Configuration versions 2.2 prior to 2.15.0. When processing untrusted YAML configuration files that contain cycles, the library can enter an infinite loop, leading to a StackOverflowError. This issue arises from the inability to detect and manage processing cycles in the YAML input.

Impact

Exploitation of this vulnerability causes a StackOverflowError, leading to a denial of service condition where the application crashes or becomes unresponsive.

Remediation

Users are advised to upgrade to Apache Commons Configuration version 2.15.0 or later, which addresses this vulnerability.