Security Alert: CWE-674 Uncontrolled Recursion in commons-collections 3.2.2 transitively bundled in GemFire 10.2.x

Products

• VMware Tanzu Gemfire

Issue/Introduction

Security scanning tools (e.g., Snyk, Veracode, OWASP Dependency-Check, Black Duck) report a security finding or policy violation on commons-collections:commons-collections:3.2.2 introduced transitively via com.vmware.gemfire:gemfire-core:10.2.x.

• Identifier: CWE-674 (Uncontrolled Recursion)
• Severity: Medium / Low (Tool dependent)
• Impacted Dependency: commons-collections:commons-collections:3.2.2

Environment

• Product: VMware Tanzu GemFire
• Version Affected: GemFire 10.2.x (including 10.2.3)

Cause

The commons-collections:3.2.2 is a transitive dependency of gemfire-core:10.2.x. Certain static code analysis tools flag version 3.2.2 due to potential uncontrolled recursion patterns within utility classes like SetUniqueList that can lead to a StackOverflowError.

Assessment & Impact

Status: NOT AFFECTED (Code Unreachable / False Positive)

1. Unreachable Code Path: GemFire 10.2.x does not call or execute the impacted class structures (e.g., SetUniqueList). Because no execution path exists connecting GemFire operations or user data to these methods, GemFire is not susceptible to stack exhaustion or Denial of Service via this finding.
2. No Published CVE: This finding is a weakness classification (CWE-674) identified by static scanners; there is no formal CVE associated with this specific usage pattern in version 3.2.2.
3. Do Not Manually Exclude: Do not exclude commons-collections using Maven or Gradle exclusion rules on GemFire 10.2.x. Excluding this library will cause NoClassDefFoundError or ClassNotFoundException errors at runtime when GemFire invokes unrelated utility methods.

Resolution

Broadcom recommends either of the following solutions based on your organization's compliance requirements:

Option 1: Mark as Not Affected / Suppress Finding (Recommended for 10.2.x)

For applications remaining on the GemFire 10.2.x release train:

• Mark the vulnerability scanner finding as Not Affected, Code Unreachable, or False Positive.
• Cite this KB article as official vendor confirmation that the vulnerable code path is unused within GemFire.

Option 2: Upgrade to GemFire 10.3

For organizations with zero-tolerance policies for legacy or flagged dependencies:

• Upgrade to GemFire 10.3.0 or higher.
• commons-collections has been completely removed from the product in GemFire 10.3.