Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Priority CRITICAL 94CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 18 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.99931 99th percentileScored 2026-11-07
Fix Partial org.apache.commons:commons-text (Maven): 1.10.0Red Hat: 25 advisoriesRed Hat: 18 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons Text | up to 1.9; 1.5 and later | — | No fix listed | CNA |
| — | org.apache.commons:commons-text (Maven) | 1.5 to before 1.10.0 | 1.10.0 | Patch available | GHSA-599f-7c49-w659 |
| — | com.guicedee.services:commons-text (Maven) | up to 1.2.2.1-jre17 | — | No fix listed | GHSA-599f-7c49-w659 |
- Apache Commons Text VendorApache Affected up to 1.9; 1.5 and later Fixed in — No fix listed CNA
- org.apache.commons:commons-text (Maven) Vendor— Affected 1.5 to before 1.10.0 Fixed in 1.10.0 Patch available GHSA-599f-7c49-w659
- com.guicedee.services:commons-text (Maven) Vendor— Affected up to 1.2.2.1-jre17 Fixed in — No fix listed GHSA-599f-7c49-w659
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:* | 1.5 to before 1.10.0 | Vulnerable | Apache |
| cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:juniper:security_threat_response_manager:*:*:*:*:*:*:*:* | before 7.5.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:-:*:*:*:*:*:* | 7.5.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up1:*:*:*:*:*:* | 7.5.0 up1 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up2:*:*:*:*:*:* | 7.5.0 up2 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up3:*:*:*:*:*:* | 7.5.0 up3 | Vulnerable | Juniper |
| cpe:2.3:h:juniper:jsa1500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:jsa3500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:jsa3800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
- cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:* Versions 1.5 to before 1.10.0 Vulnerable ·Apache
- cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:juniper:security_threat_response_manager:*:*:*:*:*:*:*:* Versions before 7.5.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:-:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up1:*:*:*:*:*:* Versions 7.5.0 up1 Vulnerable ·Juniper
- cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up2:*:*:*:*:*:* Versions 7.5.0 up2 Vulnerable ·Juniper
- cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up3:*:*:*:*:*:* Versions 7.5.0 up3 Vulnerable ·Juniper
- cpe:2.3:h:juniper:jsa1500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:jsa3500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:jsa3800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:juniper:jsa5500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:jsa5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:jsa7500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:jsa7800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
- cpe:2.3:h:juniper:jsa5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:jsa5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:jsa7500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:jsa7800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Remediation
- Fix · GHSA-599f-7c49-w659 org.apache.commons:commons-text (Maven) Fixed in 1.10.0 Advisory →
Red Hat 25 advisories
- RHSA-2025:1747 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.12 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
- RHSA-2025:1746 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
- RHSA-2024:3527 Released 2024-05-30 · Red Hat rating ModerateRed Hat AMQ Streams 2.7.0 release and security update
- Red Hat AMQ Streams 2.7.0
Show 22 more Red Hat advisories
- RHSA-2024:0775 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1706516946-1.el8, jenkins-2.426.3.1706516929-3.el8
- RHSA-2024:0778 Released 2024-02-12 · Red Hat rating ImportantJenkins and Jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
- RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8
- RHSA-2024:0776 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1706516346-1.el8, jenkins-2.426.3.1706516254-3.el8
- RHSA-2023:7288 Released 2023-11-16 · Red Hat rating ImportantRed Hat Product OCP Tools 4.14 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1699356715-1.el8, jenkins-2.414.3.1699356615-3.el8
- RHSA-2023:6179 Released 2023-10-30 · Red Hat rating CriticalRed Hat Product OCP Tools 4.13 OpenShift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1698292274-1.el8, jenkins-2.414.3.1698292201-3.el8
- RHSA-2023:6172 Released 2023-10-30 · Red Hat rating CriticalRed Hat Product OCP Tools 4.12 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1698294000-1.el8, jenkins-2.414.3.1698293911-3.el8
- RHSA-2023:6171 Released 2023-10-30 · Red Hat rating CriticalRed Hat Product OCP Tools 4.11 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1698299029-1.el8, jenkins-2.414.3.1698298955-3.el8
- RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
- RHSA-2023:3195 Released 2023-05-18 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1683009955-1.el8, jenkins-2.387.1.1683009767-3.el8
- RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Criticaljenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
- RHSA-2023:2135 Released 2023-05-04 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.3 security update
- RHPAM 7.13.1 async
- RHSA-2023:2097 Released 2023-05-03 · Red Hat rating ImportantSatellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
- RHSA-2023:1655 Released 2023-04-12 · Red Hat rating CriticalOpenShift Container Platform 4.10.56 security update
- Red Hat OpenShift Container Platform 4.10 haproxy-2.2.19-4.el8, haproxy22-2.2.19-4.el8, jenkins-2-plugins-4.10.1680703106-1.el8 +5
- RHSA-2023:1524 Released 2023-04-05 · Red Hat rating CriticalOpenShift Container Platform 4.9.59 security update
- Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1680069756-1.el8
- RHSA-2023:1006 Released 2023-03-08 · Red Hat rating ImportantRed Hat build of Quarkus 2.7.7 release and security update
- Red Hat build of Quarkus 2.7.7
- RHSA-2023:0469 Released 2023-01-26 · Red Hat rating ModerateRed Hat Integration Camel Extensions For Quarkus 2.13.2
- RHINT Camel-Q 2.13.2
- RHSA-2023:0261 Released 2023-01-18 · Red Hat rating CriticalSatellite 6.12.1 Async Security Update
- Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.18-1.el8sat, candlepin-selinux-4.1.18-1.el8sat, foreman-3.3.0.18-1.el8sat +41
- RHSA-2022:9023 Released 2022-12-14 · Red Hat rating ImportantRed Hat build of Quarkus 2.13.5 release and security update
- Red Hat build of Quarkus 2.13.5
- RHSA-2022:8902 Released 2022-12-08 · Red Hat rating ModerateRed Hat Camel for Spring Boot 3.18.3 release and security update
- RHINT Camel-Springboot 3.18.3
- RHSA-2022:8876 Released 2022-12-07 · Red Hat rating ModerateRed Hat AMQ Broker 7.10.2 release and security update
- Red Hat AMQ Broker 7
- RHSA-2022:8652 Released 2022-11-28 · Red Hat rating ImportantRed Hat Fuse 7.11.1 release and security update
- Red Hat Fuse 7.11.1
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3198, RHSA-2023:6171, RHSA-2024:0775 |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2023:3195, RHSA-2023:6172, RHSA-2024:0778 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2023:3299, RHSA-2023:6179, RHSA-2024:0776 |
| OpenShift Developer Tools and Services for OCP 4.14 | Fixed | RHSA-2023:7288, RHSA-2024:0777 |
| RHINT Camel-Q 2.13.2 | Fixed | RHSA-2023:0469 |
| RHINT Camel-Springboot 3.18.3 | Fixed | RHSA-2022:8902 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:2135 |
| Red Hat AMQ Broker 7 | Fixed | RHSA-2022:8876 |
| Red Hat AMQ Streams 2.7.0 | Fixed | RHSA-2024:3527 |
| Red Hat Fuse 7.11.1 | Fixed | RHSA-2022:8652 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:1747 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:1655 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2023:1524 |
| Red Hat Satellite 6.12 for RHEL 8 | Fixed | RHSA-2023:0261 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:2097 |
| Red Hat build of Quarkus 2.13.5 | Fixed | RHSA-2022:9023 |
| Red Hat build of Quarkus 2.7.7 | Fixed | RHSA-2023:1006 |
Not affected: 20 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- OpenShift Developer Tools and Services for OCP 4.12
- OpenShift Developer Tools and Services for OCP 4.13
- OpenShift Developer Tools and Services for OCP 4.14
- Red Hat A-MQ Online
- Red Hat Data Grid 8
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Web Server 5
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.9
- Red Hat Satellite 6.12 for RHEL 8
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat Single Sign-On 7
- Red Hat build of Apicurio Registry 2
- Red Hat build of Debezium 1
- Red Hat support for Spring Boot
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42889
- 2026-10-03 Alias added: GHSA-599f-7c49-w659
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 10
- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- [oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
- [oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
- https://security.netapp.com/advisory/ntap-20221020-0004/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
- GLSA-202301-05
- 20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory
- http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-42889
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text
Sources
- CVE-2022-42889 · CVE Program
- CVE-2022-42889 · NVD
- FIRST EPSS
- GHSA-599f-7c49-w659 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-42889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences