From 73b3893b3c1ff5fab87d96185be8bb7287072214 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Thu, 13 Aug 2026 10:59:38 -0400 Subject: [PATCH] Cap CVE-2025-48734 (commons-beanutils) range at 9.10.1/10.0.0 (fixed in 9.11/10.1) commons-beanutils was upgraded to 1.11.0 on branch_9x, branch_10x, and main, and Hadoop 3.4.3 (in 9.11) additionally dropped the shaded commons-beanutils it previously carried in hadoop-client-runtime -- so 9.11 and 10.1 are not affected. Change the range from an open "3.6.0-10.0.0" to "3.6.0-9.10.1, 10.0.0" so the fixed 9.11 release isn't swept in once it lands (9.11 sorts below 10.0.0), and add a note documenting the fix. Disposition unchanged (not_affected). Co-Authored-By: Claude Opus 4.8 --- content/solr/vex/2026-07-18-cve-2025-48734.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/content/solr/vex/2026-07-18-cve-2025-48734.md b/content/solr/vex/2026-07-18-cve-2025-48734.md index 39d566522..3e9943fc2 100644 --- a/content/solr/vex/2026-07-18-cve-2025-48734.md +++ b/content/solr/vex/2026-07-18-cve-2025-48734.md @@ -2,7 +2,7 @@ cve: CVE-2025-48734 category: - solr/vex -versions: "3.6.0-10.0.0" +versions: "3.6.0-9.10.1, 10.0.0" jars: - commons-beanutils-1.9.4.jar analysis: @@ -15,4 +15,10 @@ CVE-2025-48734 allows an attacker to access the JVM ClassLoader (and potentially CVE-2025-48734 affects all Commons BeanUtils 1.x releases before 1.11.0. Solr has bundled commons-beanutils since Solr 3.6.0, and every release that includes it, through Solr 10.0.0, ships an affected 1.x version (1.7.0, then 1.8.3, 1.9.3 and 1.9.4 — all below 1.11.0). The affected range is -therefore 3.6.0 – 10.0.0. +therefore 3.6.0 – 9.10.1 plus 10.0.0. + +The fix has landed on all active development branches: Solr 9.11 (`branch_9x`), 10.1 (`branch_10x`), +and `main` upgrade the bundled copy to commons-beanutils 1.11.0, and Hadoop 3.4.3 (shipped in 9.11) +additionally dropped the shaded commons-beanutils it previously carried inside `hadoop-client-runtime`. +So 9.11 and 10.1 are not affected, and the range is capped at 9.10.1 / 10.0.0 rather than an open +`3.6.0 – 10.0.0` that would otherwise sweep in the fixed 9.11 release.