WaratekVRT Sign in

CVE-2024-47554 Apache Commons IO

Affected softwareApache Commons IO
Severity4.3 Medium CVSS 3.1
Fixed in2.14.0
WeaknessUncontrolled resource consumption (CWE-400)
Published3 Oct 2024
Updated17 Jun 2026

Description

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.3% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to No source fix or exploit.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2026 ↗ CPU 2026-Q4 Oracle Hospitality Applications / OPERA Login (Apache Commons IO) (5.6.28.0)
Oracle Critical Patch Update July 2026 ↗ CPU 2026-Q3 Oracle SQL Developer / Infrastructure (Apache Commons VFS) (19.3-24.3)
Oracle Critical Patch Update January 2026 ↗ CPU 2026-Q1 Oracle Fusion Middleware / Console (Apache Commons IO) (12.2.1.4.0, 14.1.1.0.0)
Oracle HealthCare Applications / Install (Apache Commons IO) (4.0.0)
Oracle Critical Patch Update October 2025 ↗ CPU 2025-Q4 Oracle Analytics / Analytics Server (Apache Commons IO) (7.6.0.0.0, 8.2.0.0.0, 12.2.1.4.0)
Oracle Commerce / Content Acquisition System (Apache Commons IO) (11.4.0)
Oracle Communications / Security (Apache Commons IO) (46.6, 47.0)
Oracle Insurance Applications / EWPS (Apache Commons IO) (12.7.2.4, 13.0.0.3, 13.0.1.1)
Oracle Retail Applications / Foundation (Apache Commons IO) (16.0.3, 19.0.1)
Oracle Retail Applications / Security (Apache Commons IO) (15.0.3.1, 16.0.3, 19.0.1)
Oracle Siebel CRM / Keyword Automation (Spring Framework) (Prior to 25.8)
Oracle Siebel CRM / Marketing (Apache Commons IO) (Prior to 25.7)
Oracle Siebel CRM / Web Marketing (Apache Commons IO) (Prior to 25.7)
Oracle Systems / Core (Apache Commons IO) (4)
Oracle Critical Patch Update July 2025 ↗ CPU 2025-Q3 Oracle Communications Applications / Install (Apache Commons IO) (12.0.0.2-12.0.0.8, 15.0.0.0-15.0.1.0)
Oracle Communications Applications / Network Processor (Apache Commons IO) (7.4.0, 7.5.0)
Oracle Communications Applications / Other (Apache Commons IO) (8.0.0.9.0)
Oracle Communications Applications / Third Party (Apache Commons IO) (8.0.0.8.0)
Oracle Fusion Middleware / Third Party (Apache Commons IO) (12.2.1.4.0, 14.1.2.0.0)
Oracle Insurance Applications / Architecture (Apache Commons IO) (11.3.0-12.0.4)
Oracle Retail Applications / Installation (Apache Commons IO) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / Installation (Apache Commons IO) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Supply Chain / Core (Apache Commons IO) (9.3.6)
Oracle Utilities Applications / Tools (Apache Commons IO) (7.0.0.0.0, 7.0.0.1.0)
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Communications / Alarms, KPI, and Measurements (Apache Commons IO) (24.2.0-24.2.4)
Oracle Communications / Automated Test Suite (Apache Commons IO) (9.0.0.0)
Oracle Communications / Automated Test Suite Framework (Apache Commons IO) (24.1.0, 24.2.0, 24.3.0)
Oracle Communications / Configuration (Apache Commons IO) (24.2.2)
Oracle Communications / Configuration (Apache Commons IO) (24.2.3)
Oracle Communications / Configuration Management Platform (Apache Commons IO) (15.0.0.0.0)
Oracle Communications / Install (Apache Commons IO) (24.2.0-24.2.2)
Oracle Communications / Install (Apache Commons IO) (24.2.3)
Oracle Communications Applications / Core (Apache Commons IO) (6.0-6.1)
Oracle Communications Applications / JSP Pages (Apache Commons IO) (6.3.1)
Oracle Communications Applications / On-premise Deployment (Apache Commons IO) (12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0, 15.0.1.0.0)
Oracle Communications Applications / Security (Apache Commons IO) (12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0-15.0.1.0.0)
Oracle Communications Applications / Security (Apache Commons IO) (7.4.1, 7.4.2, 7.5.0, 7.5.1)
Oracle Communications Applications / Security (Apache Commons IO) (7.5.0, 7.4.1, 7.4.0)
Oracle Communications Applications / Security (Apache Commons IO) (8.1.0.26.0)
Oracle Construction and Engineering / Admin (Apache Commons IO) (20.12.0-20.12.17, 21.12.0-21.12.15)
Oracle Financial Services Applications / IDM Authentication (Apache Commons IO) (21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0)
Oracle Financial Services Applications / Installer (Apache Commons IO) (8.1.2.7.0)
Oracle Financial Services Applications / Platform (Apache Commons IO) (8.1.2.5, 8.1.1.4, 8.0.8.6, 8.0.7.8)
Oracle Financial Services Applications / User Interface (Apache Commons IO) (21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0)
Oracle Fusion Middleware / Core (Apache Commons IO) (12.2.1.4.0)
Oracle Fusion Middleware / Learnset Manager (Apache Commons IO) (14.1.1.0.0)
Oracle Fusion Middleware / Rest Converters (Apache Commons IO) (12.2.1.4.0, 14.1.2.0.0)
Oracle Fusion Middleware / Server, Composer (Apache Commons IO) (14.1.2.0.0)
Oracle Fusion Middleware / Workshop (Apache Commons IO) (12.2.1.4.0)
Oracle Hospitality Applications / Next-Gen SPMS (Apache Commons IO) (23.2.1)
Oracle Hyperion / Installation and Configuration (Apache Commons IO) (11.2.19.0.000)
Oracle JD Edwards / Web Runtime SEC (Apache Commons IO) (9.2.0.0-9.2.9.2)
Oracle Policy Automation / Determinations Engine (Apache Commons IO) (12.2.0-12.2.36)
Oracle Policy Automation / Generic (Apache Commons IO) (12.2.0-12.2.36)
Oracle Retail Applications / Core (Apache Commons IO) (16.0.3.16)
Oracle Retail Applications / Order Broker Foundation - OBF (Apache Commons IO) (19.1)
Oracle Retail Applications / Xenvironment (Apache Commons IO) (19.0.6, 20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1)
Oracle Supply Chain / Document Management (Apache Commons IO) (6.2.1)
Oracle Support Tools / Diagnostic Assistant (Apache Commons IO) (2.11.0-2.12.46)
Oracle Support Tools / Services Tools Bundle (Apache Commons IO) (8.00-8.18, 18.1-18.4, 19.1-19.4, 20.1-20.4, 22.2, 23.1-23.4, 24.1-24.4, 25.1)
Oracle TimesTen In-Memory Database / EM TimesTen plug-in (Apache Commons IO) (22.1.1.1.0-22.1.1.30.0)
Oracle Utilities Applications / General (Apache Commons IO) (4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3)
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Communications Applications / Configuration (Apache Commons IO) (3.0.2.0.0, 3.0.3.0.0, 3.0.3.3.0)
Oracle Communications Applications / Core (Apache Commons IO) (6.0.4-6.0.5)
Oracle Communications Applications / Solution Designer (Apache Commons IO) (8.0.0.3, 8.1.0.1)
Oracle Construction and Engineering / Document Management (Apache Commons IO) (20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.12, 24.12.0)
Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Commons IO) (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0)
Oracle Fusion Middleware / Security Framework (Apache Commons IO) (12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Analytics Server (Apache Commons IO) 7.6.0.0.0, 8.2.0.0.0, 12.2.1.4.0 7.6.0.0.0 · 8.2.0.0.0 · 12.2.1.4.0
Oracle Commerce Content Acquisition System (Apache Commons IO) 11.4.0 11.4.0
Oracle Communications Alarms, KPI, and Measurements (Apache Commons IO) 24.2.0-24.2.4
Oracle Communications Automated Test Suite (Apache Commons IO) 9.0.0.0 9.0.0.0
Oracle Communications Automated Test Suite Framework (Apache Commons IO) 24.1.0, 24.2.0, 24.3.0 24.1.0 · 24.2.0 · 24.3.0
Oracle Communications Configuration (Apache Commons IO) 24.2.2 24.2.2 · 24.2.3
Oracle Communications Configuration Management Platform (Apache Commons IO) 15.0.0.0.0 15.0.0.0.0
Oracle Communications Install (Apache Commons IO) 24.2.0-24.2.2 24.2.3
Oracle Communications Security (Apache Commons IO) 46.6, 47.0 46.6 · 47.0
Oracle Communications Applications Configuration (Apache Commons IO) 3.0.2.0.0, 3.0.3.0.0, 3.0.3.3.0 3.0.2.0.0 · 3.0.3.0.0 · 3.0.3.3.0
Oracle Communications Applications Core (Apache Commons IO) 6.0-6.1
Oracle Communications Applications Install (Apache Commons IO) 12.0.0.2-12.0.0.8, 15.0.0.0-15.0.1.0
Oracle Communications Applications JSP Pages (Apache Commons IO) 6.3.1 6.3.1
Oracle Communications Applications Network Processor (Apache Commons IO) 7.4.0, 7.5.0 7.4.0 · 7.5.0
Oracle Communications Applications On-premise Deployment (Apache Commons IO) 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0, 15.0.1.0.0 15.0.0.0.0 · 15.0.1.0.0
Oracle Communications Applications Other (Apache Commons IO) 8.0.0.9.0 8.0.0.9.0
Oracle Communications Applications Security (Apache Commons IO) 12.0.0.4.0-12.0.0.8.0, 15.0.0.0.0-15.0.1.0.0 7.4.0 · 7.4.1 · 7.4.2 · 7.5.0 · 7.5.1 · 8.1.0.26.0
Oracle Communications Applications Solution Designer (Apache Commons IO) 8.0.0.3, 8.1.0.1 8.0.0.3 · 8.1.0.1
Oracle Communications Applications Third Party (Apache Commons IO) 8.0.0.8.0 8.0.0.8.0
Oracle Construction and Engineering Admin (Apache Commons IO) 20.12.0-20.12.17, 21.12.0-21.12.15
Oracle Construction and Engineering Document Management (Apache Commons IO) 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.12, 24.12.0 24.12.0
Oracle Financial Services Applications IDM Authentication (Apache Commons IO) 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0 21.1.0.0.0 · 22.1.0.0.0 · 22.2.0.0.0
Oracle Financial Services Applications Installer (Apache Commons IO) 8.1.2.7.0 8.1.2.7.0
Oracle Financial Services Applications Platform (Apache Commons IO) 8.1.2.5, 8.1.1.4, 8.0.8.6, 8.0.7.8 8.0.7.8 · 8.0.8.6 · 8.1.1.4 · 8.1.2.5
Oracle Financial Services Applications User Interface (Apache Commons IO) 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0 21.1.0.0.0 · 22.1.0.0.0 · 22.2.0.0.0
Oracle Fusion Middleware Centralized Thirdparty Jars (Apache Commons IO) 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 12.2.1.4.0 · 14.1.1.0.0 · 14.1.2.0.0
Oracle Fusion Middleware Console (Apache Commons IO) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Core (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Learnset Manager (Apache Commons IO) 14.1.1.0.0 14.1.1.0.0
Oracle Fusion Middleware Rest Converters (Apache Commons IO) 12.2.1.4.0, 14.1.2.0.0 12.2.1.4.0 · 14.1.2.0.0
Oracle Fusion Middleware Security Framework (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Server, Composer (Apache Commons IO) 14.1.2.0.0 14.1.2.0.0
Oracle Fusion Middleware Third Party (Apache Commons IO) 12.2.1.4.0, 14.1.2.0.0 12.2.1.4.0 · 14.1.2.0.0
Oracle Fusion Middleware Workshop (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle HealthCare Applications Install (Apache Commons IO) 4.0.0 4.0.0
Oracle Hospitality Applications Next-Gen SPMS (Apache Commons IO) 23.2.1 23.2.1
Oracle Hospitality Applications OPERA Login (Apache Commons IO) 5.6.28.0 5.6.28.0
Oracle Hyperion Installation and Configuration (Apache Commons IO) 11.2.19.0.000 11.2.19.0.0
Oracle Insurance Applications Architecture (Apache Commons IO) 11.3.0-12.0.4
Oracle Insurance Applications EWPS (Apache Commons IO) 12.7.2.4, 13.0.0.3, 13.0.1.1 12.7.2.4 · 13.0.0.3 · 13.0.1.1
Oracle JD Edwards Web Runtime SEC (Apache Commons IO) 9.2.0.0-9.2.9.2
Oracle Policy Automation Determinations Engine (Apache Commons IO) 12.2.0-12.2.36
Oracle Policy Automation Generic (Apache Commons IO) 12.2.0-12.2.36
Oracle Retail Applications Core (Apache Commons IO) 16.0.3.16 16.0.3.16
Oracle Retail Applications Foundation (Apache Commons IO) 16.0.3, 19.0.1 16.0.3 · 19.0.1
Oracle Retail Applications Installation (Apache Commons IO) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications Order Broker Foundation - OBF (Apache Commons IO) 19.1 19.1
Oracle Retail Applications Security (Apache Commons IO) 15.0.3.1, 16.0.3, 19.0.1 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications Xenvironment (Apache Commons IO) 19.0.6, 20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1 19.0.6 · 20.0.5 · 21.0.4 · 22.0.2 · 23.0.2 · 24.0.1
Oracle SQL Developer Infrastructure (Apache Commons VFS) 19.3-24.3
Oracle Siebel CRM Keyword Automation (Spring Framework) Prior to 25.8
Oracle Siebel CRM Marketing (Apache Commons IO) Prior to 25.7
Oracle Siebel CRM Web Marketing (Apache Commons IO) Prior to 25.7
Oracle Supply Chain Core (Apache Commons IO) 9.3.6 9.3.6
Oracle Supply Chain Document Management (Apache Commons IO) 6.2.1 6.2.1
Oracle Support Tools Diagnostic Assistant (Apache Commons IO) 2.11.0-2.12.46
Oracle Support Tools Services Tools Bundle (Apache Commons IO) 8.00-8.18, 18.1-18.4, 19.1-19.4, 20.1-20.4, 22.2, 23.1-23.4, 24.1-24.4, 25.1 22.2 · 25.1
Oracle Systems Core (Apache Commons IO) 4 4
Oracle TimesTen In-Memory Database EM TimesTen plug-in (Apache Commons IO) 22.1.1.1.0-22.1.1.30.0
Oracle Utilities Applications General (Apache Commons IO) 4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.5.0.0.0 · 4.5.0.1.1 · 4.5.0.1.3
Oracle Utilities Applications Tools (Apache Commons IO) 7.0.0.0.0, 7.0.0.1.0 7.0.0.0.0 · 7.0.0.1.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-io:commons-io 2.0 2.14.0 unbounded

Products and versions

9 products, 10 version entries
SourceVendorProductSchemeAffected versions
nvd apache commons io generic ≥ 2.0 and ＜ 2.14.0
osv commons-io commons-io generic ≥ 2.0 and ＜ 2.14.0
nvd netapp active iq unified manager generic any version
nvd netapp bluexp generic any version
nvd netapp e-series santricity unified manager generic any version
nvd netapp e-series santricity web services proxy generic any version
nvd netapp ontap tools generic 9 · 10
nvd netapp santricity storage plugin generic any version
nvd netapp snapcenter generic any version

References

URLTags
https://github.com/apache/commons-io PACKAGE
https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1 WEB
https://security.netapp.com/advisory/ntap-20250131-0010 WEB
http://www.openwall.com/lists/oss-security/2024/10/03/2 WEB
https://security.netapp.com/advisory/ntap-20250131-0010/ Third Party Advisory

Timeline
Published2024-10-03By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.