changes_0.6.17.md

Udf Debugging Java 0.6.17, released 2025-07-31

Code name: Fix CVE-2025-48924 in org.apache.commons:commons-lang3:jar:3.16.0:compile

Summary

This release fixes the following vulnerabilities:

CVE-2025-48924 (CWE-674) in dependency org.apache.commons:commons-lang3:jar:3.16.0:compile

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVE: CVE-2025-48924 CWE: CWE-674

References

• https://ossindex.sonatype.org/vulnerability/CVE-2025-48924?component-type=maven&component-name=org.apache.commons%2Fcommons-lang3&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-48924
• https://github.com/advisories/GHSA-j288-q9x7-2f5v

Security

• #77: Fixed vulnerability CVE-2025-48924 in dependency org.apache.commons:commons-lang3:jar:3.16.0:compile

Dependency Updates

Compile Dependency Updates

• Updated org.apache.commons:commons-compress:1.27.1 to 1.28.0

Plugin Dependency Updates

• Updated com.exasol:error-code-crawler-maven-plugin:2.0.3 to 2.0.4
• Updated com.exasol:project-keeper-maven-plugin:5.1.0 to 5.2.3
• Added org.sonatype.central:central-publishing-maven-plugin:0.7.0
• Removed org.sonatype.plugins:nexus-staging-maven-plugin:1.7.0