Description
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Velocity Engine | Apache Velocity Engine – ≤ 2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | velocity | 1.7-6 | — |
| Debian 13 | velocity | 1.7-6 | — |
| Debian 12 | velocity | 1.7-6 | — |
| Debian 9 | velocity | 1.7-5+deb9u1 | DLA-2595-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | velocity | 1.7-5+deb9u1build0.20.04.1 | USN-6281-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | velocity | 1.7-5ubuntu0.18.04.1~esm1 | USN-6281-1 |
| Ubuntu Pro 16.04 LTS | velocity | 1.7-4ubuntu0.1~esm1 | USN-6281-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-4.redhat_00003.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +7 | 2.10.4-2.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-4.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jettison | 1.3.8-2.redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy +16 | 3.0.27-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy-rxjava2 +2 | 3.11.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-snakeyaml | 1.33.0-1.SP1_redhat_00001.1.el7eap | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-velocity | 1.7.0-3.redhat_00006.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.9-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.12-3.GA_redhat_00002.1.el7eap | RHSA-2025:1747 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.10.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.4-1.redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.68.0-2.redhat_00005.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.14-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.22-3.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.30-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-2.redhat_00006.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.9-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-6.Final_redhat_00007.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-3.1-api +2 | 3.1.0-6.SP3_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-jgroups-kubernetes | 1.0.16-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.3-2.Final_redhat_00002.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.60-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.11.4-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.35-1.SP1_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.3.0-1.redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.6-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.7-1.GA_redhat_00002.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:2048 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.26-1.Final_redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.7-1.GA_redhat_00002.1.el7eap | RHSA-2021:3656, RHSA-2021:2047 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-36.redhat_00013.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.9-1.redhat_00001.1.el6eap | RHSA-2021:2048, RHSA-2021:2047, RHSA-2021:2046 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES 15 SP6 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP6 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP6 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP5 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP4 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| SLES 15 SP4 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP3 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| SLES 15 SP3 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLES 15 SP2 | velocity | 1.7-3.3.1 | SUSE-SU-2021:0800-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP5 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP4 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLES for SAP 15 SP3 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP5 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP4 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SLE HPC 15 SP3 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| SUSE Manager Server Module 4.3 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| SUSE Manager Server Module 4.2 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| SUSE Manager Server Module 4.1 | snakeyaml | 1.31-150200.12.6.1 | SUSE-SU-2022:3560-1 |
| SUSE Enterprise Storage 7.1 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-javadoc-plugin | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | maven-surefire-plugins | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| SUSE Enterprise Storage 7.1 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velocity | 1.7-9.3 | openSUSE-SU-2024:11495-1 |
| openSUSE Leap 15.6 | maven-dependency-analyzer | 1.15.1-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-dependency-plugin | 3.8.1-150200.3.10.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-doxia | 2.0.0-150200.4.18.11 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-doxia-sitetools | 2.0.0-150200.3.18.3 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-invoker | 3.3.0-150200.3.7.5 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-invoker-plugin | 3.8.1-150200.3.6.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-javadoc-plugin +1 | 3.11.1-150200.4.21.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-parent | 43-150200.3.8.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-plugin-plugin +1 | 3.15.1-150200.3.15.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-plugin-tools | 3.15.1-150200.3.15.12 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-reporting-api | 4.0.0-150200.3.10.12 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-reporting-impl | 4.0.0-150200.4.9.12 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-surefire | 3.5.2-150200.3.9.20.12 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | maven-surefire-plugins +1 | 3.5.2-150200.3.9.20.2 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | plexus-velocity | 2.1.0-150200.3.10.3 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.6 | velocity-engine-core | 2.4-150200.5.3.3 | SUSE-SU-2025:0719-1 |
| openSUSE Leap 15.4 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| openSUSE Leap 15.3 | snakeyaml | 1.31-150200.3.8.1 | SUSE-SU-2022:3397-1 |
| openSUSE Leap 15.2 | velocity | 1.7-lp152.5.3.1 | openSUSE-SU-2021:0447-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | velocity +3 | 1.7-10.2.amzn2 | ALAS2-2021-1690 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.velocity:velocity | <= 1.7 | — | GHSA-59j4-wjwp-mw9m |
| Maven | org.apache.velocity:velocity-engine-parent | < 2.3 | 2.3 | GHSA-59j4-wjwp-mw9m |
Advisories 24
- RHSA-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2048 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2046 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:2047 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-6281-1 velocity vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-2595-1 velocity - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11495-1 velocity-1.7-9.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3397-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0719-1 Recommended update for Maven SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0800-1 Security update for velocity SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3560-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0447-1 Security update for velocity SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2700 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
- WID-SEC-2023-1808 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1027 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0904 SAP Patchday April 2023 BSI CERT-Bund (WID) · Apr 10, 2023
- ALAS2-2021-1690 Important: velocity security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 15, 2021
References
- https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E
- [velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement mailing-list
- [oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass mailing-list
- [announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass mailing-list
- [druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix mailing-list
- [debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update mailing-list
- [ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3 mailing-list
- [ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml mailing-list
- [ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- [ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) mailing-list
- GLSA-202107-52 vendor-advisory
- [activemq-users] 20210830 Security issues mailing-list
- [activemq-users] 20210831 RE: Security issues mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html