The vulnerability is an uncontrolled recursion that causes a StackOverflowError when Apache Commons Configuration processes YAML files containing cyclic references. The flaw results in an application crash, which can lead to denial of service. The weakness aligns with CWE‑674, indicating an infinite recursion bug.

Apache Software Foundation’s Apache Commons Configuration library versions earlier than 2.15.0 are impacted. This includes all releases from 2.2 up to just before 2.15.0. Systems that load or parse untrusted YAML configuration files using these versions are vulnerable.

The flaw has no publicly disclosed exploitation code, but an attacker can trigger it simply by supplying a crafted YAML document with cyclical references. Because the error propagates to a stack overflow, the impact is a crash of the process hosting the library, potentially leading to service unavailability. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the lack of a bound to a particular remote execution makes the risk primarily availability-focused. Prior to the update, any component that reads untrusted configuration files is at risk.