Read the docs
TI-2025-30956 Aliases CVE-2025-48734GHSA-wxr5-93ph-8wr9

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Priority HIGH 73CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 31 fixed, 15 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02018 81st percentileScored 2026-11-07
Fix Partial Apache Commons BeanUtils 1.x (Apache Software Foundation): 1.11.0Apache Commons BeanUtils 2.x (Apache Software Foundation): 2.0.0-M2+2 more productsRed Hat: 33 advisoriesRed Hat: 31 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Commons BeanUtils 1.x1.0 to before 1.11.01.11.0Patch availableCNA
ApacheApache Commons BeanUtils 2.x2.0.0-M1 to before 2.0.0-M22.0.0-M2Patch availableCNA
—commons-beanutils:commons-beanutils (Maven)1.0 to before 1.11.01.11.0Patch availableGHSA-wxr5-93ph-8wr9
—org.apache.commons:commons-beanutils2 (Maven)2.0.0-M1 to before 2.0.0-M22.0.0-M2Patch availableGHSA-wxr5-93ph-8wr9
  • Apache Commons BeanUtils 1.x VendorApache Affected 1.0 to before 1.11.0 Fixed in 1.11.0 Patch available CNA
  • Apache Commons BeanUtils 2.x VendorApache Affected 2.0.0-M1 to before 2.0.0-M2 Fixed in 2.0.0-M2 Patch available CNA
  • commons-beanutils:commons-beanutils (Maven) Vendor— Affected 1.0 to before 1.11.0 Fixed in 1.11.0 Patch available GHSA-wxr5-93ph-8wr9
  • org.apache.commons:commons-beanutils2 (Maven) Vendor— Affected 2.0.0-M1 to before 2.0.0-M2 Fixed in 2.0.0-M2 Patch available GHSA-wxr5-93ph-8wr9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:*1.0 to before 1.11.0VulnerableApache
cpe:2.3:a:apache:commons_beanutils:2.0.0:milestone1:*:*:*:*:*:*2.0.0 milestone1VulnerableApache
  • cpe:2.3:a:apache:commons_beanutils:*:*:*:*:*:*:*:* Versions 1.0 to before 1.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_beanutils:2.0.0:milestone1:*:*:*:*:*:* Versions 2.0.0 milestone1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Commons BeanUtils 1.x (Apache Software Foundation) Fixed in 1.11.0
  • Fix · CNA Apache Commons BeanUtils 2.x (Apache Software Foundation) Fixed in 2.0.0-M2
  • Fix · GHSA-wxr5-93ph-8wr9 commons-beanutils:commons-beanutils (Maven) Fixed in 1.11.0 Advisory →
  • Fix · GHSA-wxr5-93ph-8wr9 org.apache.commons:commons-beanutils2 (Maven) Fixed in 2.0.0-M2 Advisory →

Red Hat 33 advisories

  • RHSA-2025:16667 Released 2025-09-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.15 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el7eap, eap7-hornetq-2.4.11-1.Final_redhat_00001.1.el7eap, eap7-hornetq-commons-2.4.11-1.Final_redhat_00001.1.el7eap +30
  • RHSA-2025:16668 Released 2025-09-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.ep7.el7, eap7-hibernate-validator-5.3.6-1.SP1_redhat_00001.1.ep7.el7, eap7-hibernate-validator-cdi-5.3.6-1.SP1_redhat_00001.1.ep7.el7 +7
  • RHSA-2025:16409 Released 2025-09-22 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.5 release and security update
    • Red Hat AMQ Broker 7.12.5
Show 30 more Red Hat advisories
  • RHSA-2025:15814 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1756732064-1.el9, jenkins-2.516.2.1756732303-3.el9
  • RHSA-2025:15816 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1757087858-1.el8, jenkins-2.516.2.1757087588-3.el8
  • RHSA-2025:15817 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1756735456-1.el8, jenkins-2.516.2.1756738247-3.el8
  • RHSA-2025:15812 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.19 jenkins-2-plugins-4.19.1756901647-1.el9, jenkins-2.516.2.1756903379-3.el9
  • RHSA-2025:15811 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1756734507-1.el9, jenkins-2.516.2.1756733848-3.el9
  • RHSA-2025:15810 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.18 jenkins-2-plugins-4.18.1756731677-1.el9, jenkins-2.516.2.1756731431-3.el9
  • RHSA-2025:15815 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1756901992-1.el8, jenkins-2.516.2.1756902120-3.el8
  • RHSA-2025:15813 Released 2025-09-15 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1756902839-1.el8, jenkins-2.516.2.1756902453-3.el8
  • RHSA-2025:13274 Released 2025-08-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.1 release and security update
    • Red Hat AMQ Broker 7.13.1
  • RHSA-2025:12511 Released 2025-08-01 · Red Hat rating Important
    Streams for Apache Kafka 3.0.0 release and security update
    • Streams for Apache Kafka 3.0.0
  • RHSA-2025:10931 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2025:10925 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el8eap +46
  • RHSA-2025:10924 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el7eap +45
  • RHSA-2025:10926 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el9eap +46
  • RHSA-2025:10814 Released 2025-07-10 · Red Hat rating Important
    apache-commons-beanutils security update
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) apache-commons-beanutils-1.8.3-15.el7_9.1, apache-commons-beanutils-javadoc-1.8.3-15.el7_9.1
  • RHSA-2025:10459 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss Enterprise Application Platform 8.0.8
  • RHSA-2025:10452 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.33.0-3.redhat_00017.1.el8eap, eap8-activemq-artemis-cli-2.33.0-3.redhat_00017.1.el8eap, eap8-activemq-artemis-commons-2.33.0-3.redhat_00017.1.el8eap +47
  • RHSA-2025:10453 Released 2025-07-07 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.8 Security update
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.33.0-3.redhat_00017.1.el9eap, eap8-activemq-artemis-cli-2.33.0-3.redhat_00017.1.el9eap, eap8-activemq-artemis-commons-2.33.0-3.redhat_00017.1.el9eap +47
  • RHSA-2025:9922 Released 2025-06-30 · Red Hat rating Important
    Streams for Apache Kafka 2.9.1 release and security update
    • Streams for Apache Kafka 2.9.1
  • RHSA-2025:9697 Released 2025-06-25 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.3 for Spring Boot patch release.
    • Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7
  • RHSA-2025:9696 Released 2025-06-25 · Red Hat rating Important
    apache-commons-beanutils security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) apache-commons-beanutils-1.9.4-9.el9_4.1
  • RHSA-2025:9318 Released 2025-06-23 · Red Hat rating Important
    javapackages-tools:201801 security update
    • Red Hat Enterprise Linux CRB (v. 8) ant-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801, ant-1.10.5-1.module+el8.10.0+23274+27840b45.src::javapackages-tools:201801, ant-antlr-1.10.5-1.module+el8.10.0+23274+27840b45.noarch::javapackages-tools:201801 +47
  • RHSA-2025:9166 Released 2025-06-17 · Red Hat rating Important
    apache-commons-beanutils security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) apache-commons-beanutils-1.9.4-21.el10_0, apache-commons-beanutils-javadoc-1.9.4-21.el10_0
  • RHSA-2025:9117 Released 2025-06-16 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.22 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.23 commons-beanutils.commons-beanutils-1.11.0.redhat-00001.jar
  • RHSA-2025:9115 Released 2025-06-16 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.22 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el7eap
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el8eap
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el9eap
  • RHSA-2025:9114 Released 2025-06-16 · Red Hat rating Important
    apache-commons-beanutils security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) apache-commons-beanutils-1.9.4-10.el9_6
  • RHSA-2025:8919 Released 2025-06-11 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.1.SP1)
    • Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
  • RHSA-2025:8265 Released 2025-06-05 · Red Hat rating Important
    Red Hat build of Cryostat 4.0.1: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
  • RHSA-2025:3465 Released 2025-04-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.21 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el7eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el7eap +29
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-all-4.1.119-1.Final_redhat_00004.1.el8eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el8eap +30
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-netty-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-buffer-4.1.119-1.Final_redhat_00004.1.el9eap, eap7-netty-codec-4.1.119-1.Final_redhat_00004.1.el9eap +29
  • RHSA-2025:3467 Released 2025-04-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.21 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-core-2.12.7.SP1-redhat-00001.jar, commons-beanutils.commons-beanutils-1.11.0.redhat-00001.jar, io.netty.netty-common-4.1.124.Final-redhat-00001.jar +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix planned: Will not fix
Red Hat AMQ ClientsAffectedNo fix planned: Will not fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2025:8265
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2025:15813
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2025:15815
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2025:15816
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2025:15817
OpenShift Developer Tools and Services for OCP 4.16Fixed RHSA-2025:15811
OpenShift Developer Tools and Services for OCP 4.17Fixed RHSA-2025:15814
OpenShift Developer Tools and Services for OCP 4.18Fixed RHSA-2025:15810
OpenShift Developer Tools and Services for OCP 4.19Fixed RHSA-2025:15812
Red Hat AMQ Broker 7.12.5Fixed RHSA-2025:16409
Red Hat AMQ Broker 7.13.1Fixed RHSA-2025:13274
Red Hat Build of Apache Camel 4.10 for Quarkus 3.20Fixed RHSA-2025:8919
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:9696
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:9318
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:9166
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:9114
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:10814
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2025:10924, RHSA-2025:3465, RHSA-2025:9115
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2025:10925, RHSA-2025:3465, RHSA-2025:9115
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2025:10926, RHSA-2025:3465, RHSA-2025:9115
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2025:10452
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2025:10453
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2025:3467
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2025:10931
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:16668
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:16667
Red Hat JBoss Enterprise Application Platform 7.4.23Fixed RHSA-2025:9117
Red Hat JBoss Enterprise Application Platform 8.0.8Fixed RHSA-2025:10459
Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7Fixed RHSA-2025:9697
Streams for Apache Kafka 2.9.1Fixed RHSA-2025:9922
Streams for Apache Kafka 3.0.0Fixed RHSA-2025:12511
Not affected: 10 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 7.4.23
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat JBoss Web Server 6
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel - HawtIO 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48734
  2. 2026-10-03 Alias added: GHSA-wxr5-93ph-8wr9
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 · Red Hat
  5. 2026-11-03 CISA SSVC decision points changed
  6. 2026-11-05 Affected versions changed · Red Hat

References

Advisory 3

Other 3

  • TI-2014-00108 Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache… CVSS 2.0HIGH 7.5
  • TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences