Package
ghidra
Component
commons-configuration2
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The affected commons-configuration2 is bundled inside the yajsw service-wrapper distribution, which is shipped as a prebuilt, upstream-pinned dependency rather than a directly managed one, so it cannot be upgraded independently. Remediation requires upstream to adopt a service-wrapper build that bundles commons-configuration2 2.15.0 or later. The flaw is a denial-of-service (StackOverflowError) reachable only when parsing attacker-controlled YAML containing reference cycles.
Status