Security issue in dependency - CWE-674 (uncontrolled recursion)

Hi there,

Some scanning tools are reporting that commons-beanutils 1.9.4 uses a version of commons-collections (3.2.2) that's potentially vulnerable to stack overflow. More details here: https://issues.apache.org/jira/browse/COLLECTIONS-701

I tried updating the version of beanutils to beanutils2 2.0.0-M1, which uses collections 4.5.0-M3 where the issue has been fixed. It was a minor code change and the unit tests seem happy. I'll raise a PR and link to this issue shortly if that would help.

Many thanks,
James

Start by locating the dependency declaration for commons-beanutils 1.9.4 and the code changed by the attempted beanutils2 2.0.0-M1 update. Run the existing unit tests, then confirm the dependency resolves commons-collections 4.5.0-M3 and that the tests still pass.

Written by the indexing model from the issue text.