- Latest release
- 1.11.0 (May 25, 2025): no advisory affects it
- Newest unaffected release
- 20030211.134440 (Oct 15, 2005)
- Advisories
- 3 · 1 high
- Dependents
- 6,621
- Releases
- 25 since 1.0 (Nov 22, 2005)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-48734Affects 1.0 to 1.10.1 (1.11.0 is outside it)
- CVE-2019-10086Affects 1.0 to 1.9.3 (1.9.4 is outside it)
- CVE-2014-0114Affects 1.8.0 to 1.9.3 (1.9.4 is outside it)
Advisories 3
- CVE-2025-48734High 8.8
Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Affected: from 1.0, fixed in 1.11.0; from 1.0, fixed in 1.11.0.
Fixed in 1.11.0 (released May 25, 2025, 3 days before disclosure).
The latest release, 1.11.0, is not affected.
- CVE-2019-10086Unrated
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access
Affected: fixed in 1.9.4.
Fixed in 1.9.4 (released Jul 28, 2019, 23 days before disclosure).
The latest release, 1.11.0, is not affected.
- CVE-2014-0114Unrated
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir
Affected: from 1.8.0, fixed in 1.9.4.
Fixed in 1.9.4 (released Jul 28, 2019, 1915 days after disclosure).
The latest release, 1.11.0, is not affected.