medium 4.3

CVE-2024-47554 json

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

published 2024-10-03 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2976 , GHSA-78wr-2p64-hpwj

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Patch / fix

fixed in 2 distros 6

maven commons-io:commons-io 2.14.0
Apache Software Foundation Apache Commons IO 2.14.0

debian ubuntu red hat suse opensuse azure linux

commons-io Debian 14, Debian 13 2.16.0-1

debian advisories DEBIAN-CVE-2024-47554

commons-io Ubuntu Pro 14.04 LTS 2.4-2ubuntu0.1~esm2
commons-io Ubuntu Pro 16.04 LTS 2.4-2ubuntu0.16.04.1~esm1
commons-io Ubuntu Pro 18.04 LTS 2.6-2ubuntu0.18.04.1+esm1
commons-io Ubuntu Pro 20.04 LTS 2.6-2ubuntu0.20.04.1+esm1
commons-io Ubuntu Pro 22.04 LTS 2.11.0-2ubuntu0.22.04.1~esm1
commons-io Ubuntu Pro 24.04 LTS 2.11.0-2ubuntu0.24.04.1~esm1

ubuntu advisories UBUNTU-CVE-2024-47554

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

eap8-hppc jboss enterprise application platform 8.0 0.8.1-2.redhat_00001.1.el8eap
eap8-log4j jboss enterprise application platform 8.0 2.22.1-1.redhat_00002.1.el8eap
eap8-slf4j jboss enterprise application platform 8.0 2.0.16-1.redhat_00001.1.el8eap
eap8-jctools jboss enterprise application platform 8.0 4.0.2-1.redhat_00001.1.el8eap
eap8-jgroups jboss enterprise application platform 8.0 5.3.10-1.Final_redhat_00001.1.el8eap
eap8-wildfly jboss enterprise application platform 8.0 8.0.4-2.GA_redhat_00005.1.el8eap
eap8-narayana jboss enterprise application platform 8.0 6.0.3-1.Final_redhat_00001.1.el8eap
eap8-asyncutil jboss enterprise application platform 8.0 0.1.0-2.redhat_00010.1.el8eap

red hat advisories RHSA-2024:8823 RHSA-2025:4550 RHSA-2025:4549 RHSA-2025:4548 RHSA-2024:8824

apache-commons-io SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 2.18.0-150200.3.15.1
apache-commons-io SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 2.17.0-11.3.1

suse advisories SUSE-RU-2025:1150-1 SUSE-SU-2024:3596-1

apache-commons-io openSUSE Tumbleweed 2.17.0-2.1

opensuse advisories openSUSE-SU-2024:14387-1

apache-commons-io CBL-Mariner 2.0, Azure Linux 3.0 2.14.0-1

azure linux advisories AZL-50019 AZL-50031

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-47554 updated 2026-11-05 cvss 4.3

apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader

Red Hat A-MQ Clients 2 commons-io Red Hat Cryostat 3 commons-io Red Hat Cryostat 4 commons-io Red Hat AMQ Clients commons-io Red Hat build of Apache Camel - HawtIO 4 commons-io Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-cxf-bom

+8 more productsfewer

Red Hat build of Apache Camel for Spring Boot 4 commons-io Red Hat build of Apicurio Registry 2 commons-io Red Hat build of Apicurio Registry 3 commons-io Red Hat build of Debezium 2 commons-io Red Hat build of Debezium 3 commons-io Red Hat build of OptaPlanner 8 commons-io Red Hat build of Quarkus quarkus-bom Red Hat Data Grid 8 commons-io

affected: no fix available “Fix deferred”
Red Hat Enterprise Linux 7 apache-commons-io, apache-commons-io-javadoc
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 apache-commons-io, apache-commons-io-javadoc Red Hat Enterprise Linux 9 apache-commons-io, apache-commons-io-javadoc Red Hat Enterprise Linux 10 apache-commons-io
affected: no fix planned “Will not fix”
Red Hat Fuse 7 commons-io
affected: no fix planned “Out of support scope”
Red Hat Integration Camel K 1 commons-io Red Hat JBoss Enterprise Application Platform Expansion Pack commons-io Red Hat JBoss Web Server 5 commons-io Red Hat JBoss Web Server 6 jws6-tomcat-jakartaee-migration
affected: no fix available “Fix deferred”
Red Hat Process Automation 7 commons-io Red Hat Single Sign-On 7 commons-io
affected: no fix planned “Out of support scope”
Red Hat streams for Apache Kafka commons-io Red Hat streams for Apache Kafka 2 commons-io
affected: no fix available “Fix deferred”
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.22-2.GA_redhat_00001.1.el7eap, eap7-weld-ejb 3.1.11-1.Final_redhat_00001.1.el7eap, eap7-weld-jta 3.1.11-1.Final_redhat_00001.1.el7eap, eap7-weld-web 3.1.11-1.Final_redhat_00001.1.el7eap, eap7-weld-core 3.1.11-1.Final_redhat_00001.1.el7eap, eap7-apache-commons-io 2.16.1-1.redhat_00001.1.el7eap, +23 more
fixed: vendor fix RHSA-2025:4548

show 9 more

Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.22-2.GA_redhat_00001.1.el8eap, eap7-weld-ejb 3.1.11-1.Final_redhat_00001.1.el8eap, eap7-weld-jta 3.1.11-1.Final_redhat_00001.1.el8eap, eap7-weld-web 3.1.11-1.Final_redhat_00001.1.el8eap, eap7-weld-core 3.1.11-1.Final_redhat_00001.1.el8eap, eap7-apache-commons-io 2.16.1-1.redhat_00001.1.el8eap, +24 more
fixed: vendor fix RHSA-2025:4549
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.22-2.GA_redhat_00001.1.el9eap, eap7-weld-ejb 3.1.11-1.Final_redhat_00001.1.el9eap, eap7-weld-jta 3.1.11-1.Final_redhat_00001.1.el9eap, eap7-weld-web 3.1.11-1.Final_redhat_00001.1.el9eap, eap7-weld-core 3.1.11-1.Final_redhat_00001.1.el9eap, eap7-apache-commons-io 2.16.1-1.redhat_00001.1.el9eap, +24 more
fixed: vendor fix RHSA-2025:4550
Red Hat JBoss EAP 8.0 for RHEL 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap, eap8-log4j 2.22.1-1.redhat_00002.1.el8eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el8eap, eap8-jctools 4.0.2-1.redhat_00001.1.el8eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap, +74 more
fixed: vendor fix RHSA-2024:8823
Red Hat JBoss EAP 8.0 for RHEL 9 eap8-hppc 0.8.1-2.redhat_00001.1.el9eap, eap8-log4j 2.22.1-1.redhat_00002.1.el9eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el9eap, eap8-jctools 4.0.2-1.redhat_00001.1.el9eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el9eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el9eap, +74 more
fixed: vendor fix RHSA-2024:8824
Red Hat JBoss Enterprise Application Platform 7.4.22 commons-io 2.16.1.redhat-00001
fixed: vendor fix RHSA-2025:4552
Red Hat JBoss Enterprise Application Platform 8
fixed: vendor fix RHSA-2024:8826
Red Hat Streams for Apache Kafka 2.8.0
fixed: vendor fix RHSA-2024:9571
Red Hat Streams for Apache Kafka 2.9.0
fixed: vendor fix RHSA-2025:2416
Red Hat AMQ Broker 7 commons-io Red Hat JBoss Enterprise Application Platform 7.4.22 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1559 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-03)

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
maven	commons-io:commons-io	>=2.0, <2.14.0	2.14.0

Affected products

Apache Software Foundation Apache Commons IO

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

lists.apache.org /thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
vendor-advisory, web, mailing-list
openwall.com /lists/oss-security/2024/10/03/2
web, mailing-list, third-party-advisory
security.netapp.com /advisory/ntap-20250131-0010/
third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2024-47554
advisory
github.com /apache/commons-io
package
security.netapp.com /advisory/ntap-20250131-0010
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary