Critical Security Update for Apache Commons BeanUtils: CVE-2025-48734
Summary
ALSA-2025:9166: Important: apache-commons-beanutils security update. Affects apache-commons-beanutils versions < 1.9.4-21.el10_0. Fixed in 1.9.4-21.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Commons BeanUtils is a Java library that provides utility methods for accessing and modifying properties of JavaBeans. It simplifies the process of working with JavaBeans by offering a set of reusable components that can be easily integrated into Java applications. The library is widely used in various Java frameworks and applications due to its ease of use and flexibility. However, it has recently been found to have a security vulnerability that affects its PropertyUtilsBean class, which can lead to unauthorized access to enum properties.
Vulnerability Detail
The vulnerability identified as CVE-2025-48734 arises from the fact that the PropertyUtilsBean class in Apache Commons BeanUtils does not suppress an enum's declaredClass property by default. This oversight can potentially allow attackers to exploit the library to gain unauthorized access to sensitive information or manipulate the behavior of applications that rely on this library. The ramifications of this vulnerability could include data leakage, unauthorized access to application logic, and other security breaches.
How To Fix
Minimum fixed version
1.9.4-21.el10_0
This is the first release that contains the fix.
sudo dnf update apache-commons-beanutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually suppress the declaredClass property in your application code when using the PropertyUtilsBean class. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The Apache Commons BeanUtils library has a critical security vulnerability (CVE-2025-48734) that needs immediate attention. Users are advised to update to the patched version 1.9.4-21.el10_0 to mitigate potential risks. Implementing workarounds is not a permanent solution, and monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for apache-commons-beanutils →
FAQ
CVE-2025-48734 is a security vulnerability in the Apache Commons BeanUtils library that allows unauthorized access to enum properties.
If your application uses Apache Commons BeanUtils, this vulnerability could lead to unauthorized access to sensitive information or manipulation of application behavior.
If an immediate update is not possible, consider implementing a workaround by suppressing the declaredClass property in your code until you can apply the patch.
More information can be found on the official CVE page for CVE-2025-48734, which provides details about the vulnerability and its impact.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for apache-commons-beanutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
