Bug#1112669: marked as done (bookworm-pu: package libcommons-lang-java/2.6-10+deb12u1)

To: Jonathan Wiltshire <jmw@coccia.debian.org>
Subject: Bug#1112669: marked as done (bookworm-pu: package libcommons-lang-java/2.6-10+deb12u1)
From: "Debian Bug Tracking System" <owner@bugs.debian.org>
Date: Sat, 10 Jan 2026 12:01:18 +0000
Message-id: <[🔎] handler.1112669.D1112669.17680463863468246.ackdone@bugs.debian.org>
Reply-to: 1112669@bugs.debian.org
References: <E1veXdB-00000004SJC-3uci@coccia.debian.org> <175666352590.991848.9219983360895736004.reportbug@localhost>

Your message dated Sat, 10 Jan 2026 11:59:45 +0000
with message-id <E1veXdB-00000004SJC-3uci@coccia.debian.org>
and subject line Released with 12.13
has caused the Debian Bug report #1112669,
regarding bookworm-pu: package libcommons-lang-java/2.6-10+deb12u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1112669: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112669
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

--- Begin Message ---

To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: bookworm-pu: package libcommons-lang-java/2.6-10+deb12u1
From: Daniel Leidert <dleidert@debian.org>
Date: Sun, 31 Aug 2025 20:05:25 +0200
Message-id: <175666352590.991848.9219983360895736004.reportbug@localhost>

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: libcommons-lang-java@packages.debian.org
Control: affects -1 + src:libcommons-lang-java
User: release.debian.org@packages.debian.org
Usertags: pu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[ Reason ]

This upload attempts to fix CVE-2025-48924, an uncontrolled recursion
vulnerability that can lead to a StackOverflowError, for users of Debian
Bookworm.

[ Impact ]

If the update is not approved, users might be affected by CVE-2025-48924.

[ Tests ]

The patch adds a new test to check if the fix is successful. I also did some
successful manual testing.

[ Risks ]

There is the risk of regression. But the patch is rather small and tested.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

The patch uses (a backported) rewrite that avoids the recursion.

[ Other info ]

The issue has been fixed in LTS/ELTS as well.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmi0juUACgkQS80FZ8KW
0F06NA//dQqPpjOfhcRiIXI0RnDFcEGc01LA8mVAVpMZympIgZsdBS/tBN8nqWIl
tdwWEw4pb9s5qW3PeMXKx68bLPujcE9PbBzm3GVh3/jPhJ5j1rfaNXAo2LP/kCtW
Ty9EjifG1scchs8XhrzbQu5qSGNqC2ntnOZ4EepdKv92Z6j5k/7jCONM3q6vywot
zM9kh66GV/vDlE6U7KyM79ls7QX6me1fRfKYfG0IAkCi0Q8calBsOYEK6iqV10lf
awLR9Jgs9w3D12cyRZiiv5qYlaHyLOGNqJxuHiGRvP0Wm/LjPaZKTN4IvHWjLqY2
E1t1H7BkRoTYyY1rLFcWoxdayw13WgASo8zSO3ltYq2BAURaUvPqSrKL0voeIavS
SjQumLRPwcEfU3+dDzZTI8U9LZ4+g/ewarMvWvPO2D4rlKLBJwaaqej1xOjYzQV/
a6yeGjBbdRAHxH9b7QySXg+BI3YAYW9e5X2jUblGvNNTQT4N3ot/ccoVZWZXwKuz
V5FDpbTGtz7cjYC5oxsgA1/JIIHt21ZYNE/MVnhV3R1Hf2EVWXYtyu+pVPI65wFr
1nkVTxM9kBJYp3ovAX7aLNie5a30AbkxDIDv46sPPi5Azn0yxMQK9vvahnRX3wlQ
DYHzgDWJGT0fb2M+EuJGF6kuHyjV/Z5zZnbJsu3FE2I3uGrn59Y=
=b4vE
-----END PGP SIGNATURE-----

diff -Nru libcommons-lang-java-2.6/debian/changelog libcommons-lang-java-2.6/debian/changelog
--- libcommons-lang-java-2.6/debian/changelog	2022-05-23 11:24:24.000000000 +0200
+++ libcommons-lang-java-2.6/debian/changelog	2025-08-31 19:06:43.000000000 +0200
@@ -1,3 +1,11 @@
+libcommons-lang-java (2.6-10+deb12u1) bookworm; urgency=medium
+
+  * Team upload.
+  * d/patches/CVE-2025-48924.patch: Add patch to fix CVE-2025-48924.
+    - Fix an uncontrolled recursion vulnerability (closes: 1109126).
+
+ -- Daniel Leidert <dleidert@debian.org>  Sun, 31 Aug 2025 19:06:43 +0200
+
 libcommons-lang-java (2.6-10) unstable; urgency=medium
 
   * Fixed the build failure with Java 17 (Closes: #1011120)
diff -Nru libcommons-lang-java-2.6/debian/gbp.conf libcommons-lang-java-2.6/debian/gbp.conf
--- libcommons-lang-java-2.6/debian/gbp.conf	1970-01-01 01:00:00.000000000 +0100
+++ libcommons-lang-java-2.6/debian/gbp.conf	2025-08-31 19:06:43.000000000 +0200
@@ -0,0 +1,3 @@
+[DEFAULT]
+debian-branch = debian/bookworm
+pristine-tar = True
diff -Nru libcommons-lang-java-2.6/debian/patches/CVE-2025-48924.patch libcommons-lang-java-2.6/debian/patches/CVE-2025-48924.patch
--- libcommons-lang-java-2.6/debian/patches/CVE-2025-48924.patch	1970-01-01 01:00:00.000000000 +0100
+++ libcommons-lang-java-2.6/debian/patches/CVE-2025-48924.patch	2025-08-31 19:06:43.000000000 +0200
@@ -0,0 +1,162 @@
+From: Gary Gregory <garydgregory@gmail.com>
+Date: Sat, 21 Sep 2024 17:23:08 -0400
+Subject: [PATCH] Rewrite ClassUtils.getClass() without recursion to avoid
+ StackOverflowError on very long inputs.
+
+- This was found fuzz testing Apache Commons Text which relies on
+ClassUtils.
+- OssFuzz Issue 42522972:
+apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security
+exception in org.apache.commons.lang3.ClassUtils.getClass
+
+Reviewed-By: Daniel Leidert <dleidert@debian.org>
+Origin: https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53
+Bug: https://github.com/advisories/GHSA-j288-q9x7-2f5v
+Bug-Debian: https://bugs.debian.org/1109126
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-48924
+Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2025-48924
+---
+ .../java/org/apache/commons/lang/ClassUtils.java   |  46 ++++++++++-----------
+ .../apache/commons/lang/ClassUtilsOssFuzzTest.java | Bin 0 -> 17588 bytes
+ 2 files changed, 22 insertions(+), 24 deletions(-)
+ create mode 100644 src/test/java/org/apache/commons/lang/ClassUtilsOssFuzzTest.java
+
+diff --git a/src/main/java/org/apache/commons/lang/ClassUtils.java b/src/main/java/org/apache/commons/lang/ClassUtils.java
+index 82665e2..3d463d9 100644
+--- a/src/main/java/org/apache/commons/lang/ClassUtils.java
++++ b/src/main/java/org/apache/commons/lang/ClassUtils.java
+@@ -748,30 +748,27 @@ public class ClassUtils {
+      */
+     public static Class getClass(
+             ClassLoader classLoader, String className, boolean initialize) throws ClassNotFoundException {
+-        try {
+-            Class clazz;
+-            if (abbreviationMap.containsKey(className)) {
+-                String clsName = "[" + abbreviationMap.get(className);
+-                clazz = Class.forName(clsName, initialize, classLoader).getComponentType();
+-            } else {
+-                clazz = Class.forName(toCanonicalName(className), initialize, classLoader);
+-            }
+-            return clazz;
+-        } catch (ClassNotFoundException ex) {
+-            // allow path separators (.) as inner class name separators
+-            int lastDotIndex = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
+-
+-            if (lastDotIndex != -1) {
+-                try {
+-                    return getClass(classLoader, className.substring(0, lastDotIndex) +
+-                            INNER_CLASS_SEPARATOR_CHAR + className.substring(lastDotIndex + 1),
+-                            initialize);
+-                } catch (ClassNotFoundException ex2) {
++        // This method was re-written to avoid recursion and stack overflows found by fuzz testing.
++        String next = className;
++        int lastDotIndex = -1;
++        do {
++            try {
++                Class clazz;
++                if (abbreviationMap.containsKey(className)) {
++                    String clsName = "[" + abbreviationMap.get(className);
++                    clazz = Class.forName(clsName, initialize, classLoader).getComponentType();
++                } else {
++                    clazz = Class.forName(toCanonicalName(className), initialize, classLoader);
++                }
++                return clazz;
++            } catch (final ClassNotFoundException ex) {
++                lastDotIndex = next.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
++                if (lastDotIndex != -1) {
++                    next = next.substring(0, lastDotIndex) + INNER_CLASS_SEPARATOR_CHAR + next.substring(lastDotIndex + 1);
+                 }
+             }
+-
+-            throw ex;
+-        }
++        } while (lastDotIndex != -1);
++        throw new ClassNotFoundException(next);
+     }
+ 
+     /**
+@@ -886,11 +883,12 @@ public class ClassUtils {
+      */
+     private static String toCanonicalName(String className) {
+         className = StringUtils.deleteWhitespace(className);
++        final String arrayMarker = "[]";
+         if (className == null) {
+             throw new NullArgumentException("className");
+-        } else if (className.endsWith("[]")) {
++        } else if (className.endsWith(arrayMarker)) {
+             StrBuilder classNameBuffer = new StrBuilder();
+-            while (className.endsWith("[]")) {
++            while (className.endsWith(arrayMarker)) {
+                 className = className.substring(0, className.length() - 2);
+                 classNameBuffer.append("[");
+             }
+diff --git a/src/test/java/org/apache/commons/lang/ClassUtilsOssFuzzTest.java b/src/test/java/org/apache/commons/lang/ClassUtilsOssFuzzTest.java
+new file mode 100644
+index 0000000..5ab7334
+--- /dev/null
++++ b/src/test/java/org/apache/commons/lang/ClassUtilsOssFuzzTest.java
+@@ -0,0 +1,64 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package org.apache.commons.lang;
++
++import junit.framework.TestCase;
++
++/**
++ * Tests {@link ClassUtils}.
++ */
++public class ClassUtilsOssFuzzTest extends TestCase {
++
++    public ClassUtilsOssFuzzTest(String name) {
++        super(name);
++    }
++
++    /**
++     * Tests that no StackOverflowError is thrown.
++     * <p>
++     * OSS-Fuzz Issue 42522972: apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security exception in org.apache.commons.lang.ClassUtils.getClass
++     * </p>
++     */
++    public void testGetClassLongIllegalName() throws Exception {
++        // Input from Commons Text clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-5447769450741760
++        assertGetClassThrowsClassNotFound(
++                "ˇda´~e]W]~t$t${.ubase64encoder{con+s{.ubase64encoder{con+s~t....................................ˇˇˇˇˇˇˇˇˇˇ&${localhot:ˇˇˇˇˇˇ4ˇ..................................s${.!.${.. \\E],${conÅEEE]W€EÅE.!${.ubase64encoder{conÅEEE]W€EÅE.!${.ubase64encoder{con+s~t....................................ˇˇˇˇˇˇˇˇˇˇ&${localhot:ˇˇˇˇˇˇ-636ˇ...............................................................t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--......t]V]W€EÅE.!$${.u--}" );
++    }
++
++    /**
++     * Tests that no StackOverflowError is thrown.
++     */
++
++    public void testGetClassLongName() throws Exception {
++        assertGetClassThrowsClassNotFound( StringUtils.repeat("a.", 5_000) + "b" );
++    }
++
++    private void assertGetClassThrowsClassNotFound( String className ) throws Exception {
++        assertGetClassThrowsException( className, ClassNotFoundException.class );
++    }
++
++    private void assertGetClassThrowsException( String className, Class exceptionType ) throws Exception {
++        try {
++            ClassUtils.getClass( className );
++            fail( "ClassUtils.getClass() should fail with an exception of type " + exceptionType.getName() + " when given class name \"" + className + "\"." );
++        }
++        catch( Exception e ) {
++            assertTrue( exceptionType.isAssignableFrom( e.getClass() ) );
++        }
++    }
++}
diff -Nru libcommons-lang-java-2.6/debian/patches/series libcommons-lang-java-2.6/debian/patches/series
--- libcommons-lang-java-2.6/debian/patches/series	2022-05-23 11:23:11.000000000 +0200
+++ libcommons-lang-java-2.6/debian/patches/series	2025-08-31 19:06:43.000000000 +0200
@@ -1,2 +1,3 @@
 01-source-encoding.patch
 02-java17-compatibility.patch
+CVE-2025-48924.patch

--- End Message ---

--- Begin Message ---

To: 1112669-done@bugs.debian.org

Subject: Released with 12.13

From: Jonathan Wiltshire <jmw@coccia.debian.org>

Date: Sat, 10 Jan 2026 11:59:45 +0000

Message-id: <E1veXdB-00000004SJC-3uci@coccia.debian.org>
Package: release.debian.org\nVersion: 12.13\n\nThis update has been released as part of Debian 12.13.
--- End Message ---

Reply to:

Prev by Date: Bug#1114685: marked as done (bookworm-pu: package libhtp/1:0.5.42-1+deb12u1)
Next by Date: Bug#1114821: marked as done (bookworm-pu: package rust-cbindgen-web/0.27.0-1~deb12u1)
Previous by thread: Bug#1114685: marked as done (bookworm-pu: package libhtp/1:0.5.42-1+deb12u1)
Next by thread: Bug#1114821: marked as done (bookworm-pu: package rust-cbindgen-web/0.27.0-1~deb12u1)
Index(es):
- Date
- Thread