Security - org.apache.commons:commons-lang3 has a security issue : Uncontrolled Recursion

[GaelCO]

Hi,

org.apache.commons:commons-lang3 3.0 contains a security issue : CVE-2025-48924
This could be fixed with update this library with 3.18 version.
Last version is 3.19 (https://commons.apache.org/proper/commons-lang/changes.html)

[GaelCO]

@RonRadtke Thank you for this library and its maintenance.
I think that in the correction, you misspelled the version.I made the same mistake during a test, because of lang3
=> implementation 'org.apache.commons:commons-lang3:20' instead implementation 'org.apache.commons:commons-lang3:3.20'

[RonRadtke]

@GaelCO thanks for the hint, I really forgot the last number, but it would be 'org.apache.commons:commons-lang3:20:0''

[jayce-vu]

does have any update here?

[RonRadtke]

does have any update here?

About what? Lib is updated

[euphbriggs]

I believe the version number in android/build.gradle may be wrong.

When I try to build from 0.24.2, I see error messages saying that org.apache.commons:commons-lang3 at version 20:0 couldn't be resolved.

I tried manually changing the line that I linked to above to implementation 'org.apache.commons:commons-lang3:3.20.0' and it resolved the issue.

I'm not an Android dev, so I may be misunderstanding the situation. I wanted to provide the info I had, though, in case it helped.

[RonRadtke]

@euphbriggs Thank you! That took a while to see the missing "3" sorry

[euphbriggs]

Awesome, I'm glad I could help! 😄

Thanks for the quick reply and resolution!

[RonRadtke]

024.3 is published

[jslok]

FAILURE: Build failed with an exception.

* What went wrong:
Could not determine the dependencies of task ':app:buildReleasePreBundle'.
> Could not resolve all dependencies for configuration ':app:releaseRuntimeClasspath'.
   > Could not find org.apache.commons:commons-lang3:3.20.
     Searched in the following locations:
       - https://central.sonatype.com/repository/maven-snapshots/org/apache/commons/commons-lang3/3.20/commons-lang3-3.20.pom
       - https://repo.maven.apache.org/maven2/org/apache/commons/commons-lang3/3.20/commons-lang3-3.20.pom
       - https://dl.google.com/dl/android/maven2/org/apache/commons/commons-lang3/3.20/commons-lang3-3.20.pom
       - https://www.jitpack.io/org/apache/commons/commons-lang3/3.20/commons-lang3-3.20.pom
     Required by:
         project :app > project :react-native-blob-util

I think implementation 'org.apache.commons:commons-lang3:3.20:0' should be implementation 'org.apache.commons:commons-lang3:3.20.0'? Replace last colon with period

[RonRadtke]

I'm sorry.... I have no idea how I managed to get that so dman wrong :D
Fix is on its way to npm