dev-java/commons-beanutils-1.11.0-r1

▸ GLSA 202601-05 Commons-BeanUtils: Arbitary Code Execution this version unaffected high remote 2026-01-26

A vulnerability has been discovered in Commons-BeanUtils, which can lead to execution of arbitrary code.

Announced: 2026-01-26
Revised: 2026-01-26
Access: remote
Bugs: #960929
Advisory: https://security.gentoo.org/glsa/202601-05

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-java/commons-beanutils	*	< 1.11.0	>= 1.11.0

Background

Commons-beanutils provides easy-to-use wrappers around Reflection and Introspection APIs

Description

Multiple vulnerabilities have been discovered in Commons-BeanUtils. Please review the CVE identifiers referenced below for details.

Impact

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Workaround

There is no known workaround at this time.

Resolution

All Commons-BeanUtils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/commons-beanutils-1.11.0"

References

CVE-2025-48734

▸ GLSA 202405-21 Commons-BeanUtils: Improper Access Restriction this version unaffected normal remote 2024-05-08

A vulnerability has been discovered in Commons-BeanUtils, which could lead to execution of arbitrary code.

Announced: 2024-05-08
Revised: 2024-05-08
Access: remote
Bugs: #739346
Advisory: https://security.gentoo.org/glsa/202405-21

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-java/commons-beanutils	*	< 1.9.4	>= 1.9.4

Background

Commons-beanutils provides easy-to-use wrappers around Reflection and Introspection APIs

Description

A vulnerability has been discovered in Commons-BeanUtils. Please review the CVE identifier referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Commons-BeanUtils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/commons-beanutils-1.9.4"

References

CVE-2019-10086

▸ GLSA 201607-09 Commons-BeanUtils: Arbitrary code execution this version unaffected normal remote 2016-07-20

Apache Commons BeanUtils does not properly suppress the class property, which could lead to the remote execution of arbitrary code.

Announced: 2016-07-20
Revised: 2016-07-20
Access: remote
Bugs: #534498
Advisory: https://security.gentoo.org/glsa/201607-09

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-java/commons-beanutils	*	< 1.9.2	>= 1.9.2

Background

Commons-beanutils provides easy-to-use wrappers around Reflection and Introspection APIs

Description

Apache Commons BeanUtils does not suppress the class property, which allows for the manipulation of the ClassLoader.

Impact

Remote attackers could potentially execute arbitrary code with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All Commons BeanUtils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-java/commons-beanutils-1.9.2"

References

CVE-2014-0114