Hi,

The following vulnerability was published for commons-configuration2.

CVE-2026-45205[0]:
| Uncontrolled Recursion vulnerability in Apache Commons.  When
| processing an untrusted configuration file, Commons Configuration
| will throw a StackOverflowError for YAML input with cycles. This
| issue affects Apache Commons: from 2.2 before 2.15.0.  Users are
| recommended to upgrade to version 2.15.0, which fixes the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-45205
https://www.cve.org/CVERecord?id=CVE-2026-45205
[1] https://www.openwall.com/lists/oss-security/2026/05/14/5
[2] https://github.com/apache/commons-configuration/pull/634
[3] https://github.com/apache/commons-configuration/commit/b51f6bf26e774f3416fdf782a5e1edf33f32ba82

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
commons-configuration2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1136705@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated commons-configuration2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 11:48:31 +0200
Source: commons-configuration2
Architecture: source
Version: 2.15.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1136705
Changes:
 commons-configuration2 (2.15.1-1) unstable; urgency=medium
 .
   * New upstream release
     - Fixes CVE-2026-45205: StackOverflowError on YAML input with cycles
       (Closes: #1136705)
     - New dependencies on libcommons-io-java and libjakarta-servlet-api-java
     - Ignore the httpcore-nio and junit-pioneer dependencies
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Removed the Rules-Requires-Root field
   * Updated debian/watch to track the GitHub tags
Checksums-Sha1:
 78fa718fc77f3d5244986ac488c6bd4b895df3ba 2774 commons-configuration2_2.15.1-1.dsc
 e49b66ab78aee8ba2e5c4ad8e363397746b271b2 730988 commons-configuration2_2.15.1.orig.tar.xz
 3566d3a2efa61aa063d4d7487241c3603a8af232 5356 commons-configuration2_2.15.1-1.debian.tar.xz
 3dbe8f3e85bfe462fcbe1a23ce9815b97fd3ff9d 19813 commons-configuration2_2.15.1-1_source.buildinfo
Checksums-Sha256:
 ebb34b1905fca3aec726e65d585e4ceae07b0a2a76aef9652a0ce9b168dd1305 2774 commons-configuration2_2.15.1-1.dsc
 d38605e3650d982eec0a828d7d5948a1867b323c3160fec91eed6c0b9cd7b54c 730988 commons-configuration2_2.15.1.orig.tar.xz
 bf788a4560204e108c56f50225bd956946c9e9083651b79f142dfc1afb116e39 5356 commons-configuration2_2.15.1-1.debian.tar.xz
 c6ba4c41973adc2d2767f066835012578536301944e26b81a69f2b9e775b5308 19813 commons-configuration2_2.15.1-1_source.buildinfo
Files:
 335567c040ddb8103ca8a9df4c130776 2774 java optional commons-configuration2_2.15.1-1.dsc
 cb6156b4306621012702cf24cb67950a 730988 java optional commons-configuration2_2.15.1.orig.tar.xz
 47fbc8c95678f63af198b4acf0761dc6 5356 java optional commons-configuration2_2.15.1-1.debian.tar.xz
 ed432e9c884dd16f9af1e76b36eee6aa 19813 java optional commons-configuration2_2.15.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrZ6ygSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsMAIP/1HjH8k8tpzc9tMUBGiq/YPnBNctUqpv
sl7oKw+7WeDAXKti8/UdK63z3vaaapDJp2hPwpXee2/Oy+Nw41cDDHX4Ben2+SZs
nD42tT8f4vxxDBFnEdpmq/JXawxdhwPezLZr4dGMx1uZuwlJKkRMiI+W+5N419vl
+wrVffTE0/C1uXQaBjTTaeo0NSiD9ILavTgQnZgj/Q692vu5s5DpTBB1R8Gjr7nv
lTYotKze/qIHzL7lCSK6H5ze+1GgfiWpctxRhZ8Rxbji1AQ3016IyPAnuCKzWP1r
CHD90Io+4YfXs5zMMI/jVVJK4fZdWK68690wXvb05k6jF7tm7oRCAUp+Yf9jGQWu
mrQc+6Z6NHk60Sz6s2NigUmxK1mFs/9fYM18h9ehXUsbrbL9A9xWMjAZYssRTQNs
ie90NU2cSAn5KymBP4kmBbnDiIZQ2g/cF5raXuiSc1KNQqwVdZFN9v8NVsX7UAMe
OPePUZqm2wXH+ts9hvbD7x0FJrCI8WSbH2+DyGwO9/XNRbAjQ1Fccm7JwPL/MoZ+
V/jYJRZ+3cUAjaylfFqo+ONyn4A5xgEMcQ5aIRNXq2E9i7ZpVhsLvGq21xdC+zHh
yYzry5HiyRiP+sGpLTCJzYHZ4D7n8VAb4gK/7YKkuwfnxQH01J5aoL30aFsWUkV6
+6RrHtlBSHq2
=AUEv
-----END PGP SIGNATURE-----