The vulnerability is an uncontrolled recursion that causes a StackOverflowError when Apache Commons Configuration processes YAML files containing cyclic references. The flaw results in an application crash, which can lead to denial of service. The weakness aligns with CWE‑674, indicating an infinite recursion bug.

Apache Software Foundation’s Apache Commons Configuration library versions earlier than 2.15.0 are impacted. This includes all releases from 2.2 up to just before 2.15.0. Systems that load or parse untrusted YAML configuration files using these versions are vulnerable.

The flaw has no publicly disclosed exploitation code, but an attacker can trigger it simply by supplying a crafted YAML document with cyclic references. Because the error propagates to a stack overflow, the impact is a crash of the process hosting the library, potentially leading to service unavailability. The CVSS score of 5.3 indicates medium severity, and the EPSS score is less than 1 %, reflecting low likelihood of exploitation. The vulnerability is not listed in CISA KEV, and the lack of a bound to a particular remote execution means the risk is primarily availability-focused. Prior to the update, any component that reads untrusted configuration files is at risk.