Ubuntu alert USN-8364-1 (libcommons-lang-java, libcommons-lang3-java)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8364-1] Apache Commons Lang vulnerability
Date:
             
 
Tue, 02 Jun 2026 15:15:37 +0000
Message-ID:
             
 
<E1wUQq9-0006In-FX@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8364-1
June 02, 2026

libcommons-lang-java, libcommons-lang3-java vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Apache Commons Lang could be made to crash if it received specially crafted input.

Software Description:
- libcommons-lang-java: an extension of the java.lang package
- libcommons-lang3-java: an extension of the java.lang package

Details:

It was discovered that Apache Commons Lang incorrectly handled recursion
in the ClassUtils.getClass method. An attacker could possibly use this
issue to cause Apache Commons Lang to crash, resulting in a denial of
service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  libcommons-lang-java            2.6-10ubuntu0.1
  libcommons-lang3-java           3.14.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  libcommons-lang-java            2.6-9ubuntu0.22.04.1
  libcommons-lang3-java           3.11-1ubuntu0.1

Ubuntu 20.04 LTS
  libcommons-lang-java            2.6-9ubuntu0.20.04.1~esm1
                                  Available with Ubuntu Pro
  libcommons-lang3-java           3.8-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libcommons-lang-java            2.6-8ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  libcommons-lang3-java           3.8-1~18.04.2+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libcommons-lang-java            2.6-6ubuntu2+esm1
                                  Available with Ubuntu Pro
  libcommons-lang3-java           3.4-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  libcommons-lang-java            2.6-3ubuntu2+esm1
                                  Available with Ubuntu Pro
  libcommons-lang3-java           3.2.1-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8364-1
  CVE-2025-48924

Package Information:
  https://launchpad.net/ubuntu/+source/libcommons-lang-java...
  https://launchpad.net/ubuntu/+source/libcommons-lang3-jav...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoe82UACgkQcpJm3tlz
hgFmDRAAueaC07Cd9rFBYt4FPrGcC2QteDBWnlu/0bW7UUZw9CcalTSq+oM/uIsI
7YEv+2c9bdH3mQeh69EC0KwgFnk1iagynxBvvppu932wuEbFMpWiRMik1RB1AxvV
7HpEj3tUtJgNxkNrmmw8DeaphpnKDzTFNQAaoPryn3Newlpd17G+UeafvsYl4AcN
l+0YtfNdaZnV9oJFjpuFpZCggsOqZyb7opAOpgEweBCbu8fs2HG7KofT4/jPndOx
v87jFNAZnevI46dPPO4ILKuUsV5NPo0u89cr7wSx1LfbnGERj7EZKfTSBQ60kMHg
157YZ0LYMUCTrcEjDKiHq+UTlBM5doUQFTKGHbbM5BlVwDy7thd2EvPGNJD1KYDx
pv/uuRk8ByCca01fHrzFruM9g11tNYgd3LQtePEqiR+4R6TAgAG4BfkarwYjhBJY
hGBT3HwtaPElr5S8UxRNbNyFW/Ujgn15cQpehWILvYSKVcfBAIs8xayrLoLOABx8
5OUTkARoZMwrDrKcIm1Mk12+BDOQZU6hGqgvq3gpYb7esrLAA514qAnrtbYH4lhZ
V7PWGfTveerwfNg0SG/A3CqnSfVAQGbcgNw20OAy5QwpuDtQgrt323ca+TRhZyrd
+16oAZfxy0IBkklcZx6YSl0/uJzsqYhzjBTLCPrnDMsltmbvMCg=
=TEd2
-----END PGP SIGNATURE-----