Home / mailings [USN-8322-1] Apache Commons BeanUtils vulnerability
Posted on 27 May 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8322-1
May 27, 2026
commons-beanutils vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Apache Commons BeanUtils could be made to run programs if it received
specially crafted input.
Software Description:
- commons-beanutils: Apache Commons BeanUtils - Utility for manipulating Java beans
Details:
It was discovered that Apache Commons BeanUtils incorrectly allowed
access to the declaredClass property of Java enum objects when handling
externally supplied property paths. An attacker could possibly use this
issue to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libcommons-beanutils-java 1.9.4-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
libcommons-beanutils-java 1.9.4-1+deb11u1build0.22.04.1
Ubuntu 20.04 LTS
libcommons-beanutils-java 1.9.4-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
libcommons-beanutils-java 1.9.3-1ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libcommons-beanutils-java 1.9.2-3ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 14.04 LTS
libcommons-beanutils-java 1.9.1-1ubuntu0.1~esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8322-1
CVE-2025-48734
Package Information:
https://launchpad.net/ubuntu/+source/commons-beanutils/1.9.4-1+deb11u1build0.22.04.1
--===============6616732511814195784==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
