Skip to content

[Security] Bump commons-io from 2.7 to 2.14.0

dependabot requested to merge dependabot-maven-commons-io-commons-io-2.14.0 into main

Bumps commons-io from 2.7 to 2.14.0. This update includes a security fix.

Vulnerabilities fixed

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Patched versions: 2.14.0 Affected versions: >= 2.0, < 2.14.0


Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports