CVE-2024-47554

Name of the Vulnerable Software and Affected Versions Apache Commons IO versions 2.0 through 2.13.x

Description The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO from version 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Recommendations Upgrade to version 2.14.0 or later, which fixes the issue. As a temporary workaround, consider disabling the org.apache.commons.io.input.XmlStreamReader class until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the XmlStreamReader class in the affected API endpoint until the issue is resolved.