Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

MEDIUM 4.3CVE-2024-47554 · GHSA-78wr-2p64-hpwj · Published 03/10/2024 · updated 17/06/2026

In short

CVE-2024-47554 is a MEDIUM (CVSS 4.3) vulnerability affecting commons-io:commons-io, commons io (apache), ontap tools (netapp).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.8% of all vulnerabilities.
Fix: update to 2.14.0 or later.

Package	Affected versions	Patched versions
commons-io:commons-io Maven	`≥ 2.0, < 2.14.0`	`2.14.0`
commons io apache	`≥ 2.0, < 2.14.0`	`2.14.0`
ontap tools netapp	`= 10= 9`	No fix yet

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

NVD description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-47554 · ADVISORY
apache/commons-io · PACKAGE
lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1 · WEB
security.netapp.com/advisory/ntap-20250131-0010 · WEB
openwall.com/lists/oss-security/2024/10/03/2 · WEB
security.netapp.com/advisory/ntap-20250131-0010 · Third Party Advisory

More vulnerabilities in commons-io:commons-io

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

commons-io:commons-io

Maven

≥ 2.0, < 2.14.0

2.14.0

commons io

apache

≥ 2.0, < 2.14.0

2.14.0

ontap tools

netapp

= 10= 9

No fix yet

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

NVD description