Red Hat Security Advisory: apache-commons-beanutils security update

Fixed packages 2

Vulnerabilities 1

• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2368956
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9166.json
• report
  https://access.redhat.com/security/cve/CVE-2025-48734
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48734
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48734
• advisory
  https://github.com/advisories/GHSA-wxr5-93ph-8wr9
• article
  https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc
• article
  https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9
• article
  https://www.openwall.com/lists/oss-security/2025/05/28/6