CVE-2025-46392

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations. Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

• CWE-400

• https://lists.apache.org/thread/y1pl0mn3opz6kwkm873zshjdxq3dwq5sMailing List, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2024-29131Not Applicable
• https://www.cve.org/CVERecord?id=CVE-2024-29133Not Applicable

Published

May 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46387CWE-639 Authorization Bypass Through User-Controlled Key8.8
• CVE-2025-46388CWE-200 Exposure of Sensitive Information to an Unauthorized…4.3
• CVE-2025-46389CWE-620: Unverified Password Change6.5
• CVE-2025-4639CWE-611 Improper Restriction of XML External Entity Referenc…8.8
• CVE-2025-46390CWE-204: Observable Response Discrepancy7.5
• CVE-2025-46391CWE-284: Improper Access Control6.5
• CVE-2025-46393In multispectral MIFF image processing in ImageMagick before…5.3
• CVE-2025-46394In tar in BusyBox through 1.37.0, a TAR archive can have fil…3.3
• CVE-2025-46397A flaw was found in xfig. This vulnerability allows possible…7.8
• CVE-2025-46398In xfig diagramming tool, a stack-overflow while running fig…5.5
• CVE-2025-46399A flaw was found in fig2dev. This vulnerability allows avail…5.5
• CVE-2025-4640Out-of-bounds Write vulnerability in PointCloudLibrary pcl a…8.3