CVE-2024-47554

—

CVSS 3.1

4.3 medium

EPSS

1%p67

Published

Oct 3, 2024 (Oct 3, 2024)

Modified

Jun 17, 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Vendors: apache netapp
Products: commons io, active iq unified manager, bluexp, e-series santricity unified manager, e-series santricity web services proxy, ontap tools, santricity storage plugin, snapcenter
Weakness: CWE-400
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.