René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"commons-lang-2.6.jar: 2 vulnerabilities (highest severity is: 9.8) [master] (reachable)","articleBody":"\u003cdetails\u003e\n  \u003csummary\u003e📂 Vulnerable Library - \u003cstrong\u003ecommons-lang-2.6.jar\u003c/strong\u003e\u003c/summary\u003e\n\nCommons Lang, a package of Java utility classes for the\n        classes that are in java.lang's hierarchy, or are considered to be so\n        standard as to justify existence in java.lang.\n\n**Library home page:** [ http://www.apache.org/ ](http://www.apache.org/)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar\n\n\n\u003c/details\u003e\n\n\n# Findings\n| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |\n| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |\n| [ CVE-842749-413332 ](https://www.mend.io/vulnerability-database/CVE-842749-413332) | 🟣 Critical | 9.8 | N/A | N/A | commons-lang-2.6.jar | Direct | N/A | ❌ | |\n| [ CVE-2025-48924 ](https://www.mend.io/vulnerability-database/CVE-2025-48924) | 🟠 Medium | 6.9 | Not Defined | \u003c 1% | commons-lang-2.6.jar | Direct | N/A | ❌ |\u003cimg src='https://whitesource-resources.whitesourcesoftware.com/viaRed.png' width=20 height=22\u003e Reachable |\n\n\n# Details\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟣CVE-842749-413332\n  \u003c/summary\u003e\n\n### Vulnerable Library - **commons-lang-2.6.jar**\n\nCommons Lang, a package of Java utility classes for the\n        classes that are in java.lang's hierarchy, or are considered to be so\n        standard as to justify existence in java.lang.\n\n**Library home page:** [ http://www.apache.org/ ](http://www.apache.org/)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **commons-lang-2.6.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Vulnerability Details\n\nCreated automatically by the test suite\n\n**Publish Date:** Jun 07, 2010 05:12 PM\n\n**URL:** [ CVE-842749-413332 ](https://www.mend.io/vulnerability-database/CVE-842749-413332)\n\n**Threat Assessment**\n\nExploit Maturity:N/A\n\nEPSS:N/A\n\n**Score:** 9.8\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** \n\n**Release Date:** \n\n**Fix Resolution :** \n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\n 🟠CVE-2025-48924\n  \u003c/summary\u003e\n\n### Vulnerable Library - **commons-lang-2.6.jar**\n\nCommons Lang, a package of Java utility classes for the\n        classes that are in java.lang's hierarchy, or are considered to be so\n        standard as to justify existence in java.lang.\n\n**Library home page:** [ http://www.apache.org/ ](http://www.apache.org/)\n\n**Path to dependency file:** /pom.xml\n\n**Path to vulnerable library:** /home/wss-scanner/.m2/repository/commons-lang/commons-lang/2.6/commons-lang-2.6.jar\n\n\n\n**Dependency Hierarchy:**\n\n\n- ❌  **commons-lang-2.6.jar** (Vulnerable Library)\n\n\n\n\n***\n\n### Reachability Analysis\nThis vulnerability is potentially reachable:\n\n```\n- org.owasp.benchmark.helpers.LDAPServer (Application)\n    - org.apache.directory.server.ldap.LdapServer (Extension)\n        - org.apache.directory.server.core.security.CoreKeyStoreSpi (Extension)\n            - org.apache.commons.lang.ArrayUtils (Extension)\n                - org.apache.commons.lang.builder.ToStringStyle (Extension)\n                    -\u003e ❌ org.apache.commons.lang.ClassUtils (Vulnerable Component)\n```\n***\n\n### Vulnerability Details\n\nUncontrolled Recursion vulnerability in Apache Commons Lang.\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a\nStackOverflowError could cause an application to stop.\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.\n Mend Note: The description of this vulnerability differs from MITRE. \n\n**Publish Date:** Jul 11, 2025 02:56 PM\n\n**URL:** [ CVE-2025-48924 ](https://www.mend.io/vulnerability-database/CVE-2025-48924)\n\n**Threat Assessment**\n\nExploit Maturity:Not Defined\n\nEPSS:\u003c 1%\n\n**Score:** 6.9\n\n\n***\n### Suggested Fix\n\n**Type:** Upgrade version\n\n**Origin:** \n\n**Release Date:** \n\n**Fix Resolution :** \n\n\n\u003c/details\u003e\n\n[comment]: \u003c\u003e (\u003cMEND_ISSUE_METADATA\u003e{\"identifier\":\"commons-lang-2.6.jar\",\"repoName\":\"BenchmarkJava\",\"branchName\":\"master\",\"type\":\"SCA_DEP\"}\u003c/MEND_ISSUE_METADATA\u003e)","author":{"url":"https://github.com/mend-developer-platform-dev[bot]","@type":"Person","name":"mend-developer-platform-dev[bot]"},"datePublished":"2025-09-28T05:43:39.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/35/BenchmarkJava/issues/35"}