CVE catalog
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav
- Severity
- High · CVSS 7.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 29.08% · Oct 25, 2026
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | commons-beanutils | sid | 1.11.0-1 | fixed |
| Debian | commons-beanutils | forky | 1.11.0-1 | fixed |
| Debian | commons-beanutils | trixie | 1.10.1-1.1 | fixed |
| Debian | commons-beanutils | bookworm | 1.9.4-1+deb12u1 | fixed |
| Cpe | commons_beanutils | Not reported | Not reported | unknown |
| Cpe | nifi | Not reported | Not reported | unknown |
| Cpe | debian_linux | Not reported | Not reported | unknown |
| Cpe | leap | Not reported | Not reported | unknown |
| Cpe | fedora | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_desktop | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_eus | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_server | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_server_aus | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_server_tus | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_workstation | Not reported | Not reported | unknown |
| Cpe | jboss_enterprise_application_platform | Not reported | Not reported | unknown |
| Cpe | agile_product_lifecycle_management | Not reported | Not reported | unknown |
| Cpe | agile_product_lifecycle_management | Not reported | Not reported | unknown |
| Cpe | agile_product_lifecycle_management_integration_pack | Not reported | Not reported | unknown |
| Suse | apache-commons-beanutils | linux enterprise server 12 sp4 | 1.9.2-3.3.1 | fixed |
| Suse | apache-commons-beanutils | linux enterprise server for sap applications 12 sp4 | 1.9.2-3.3.1 | fixed |
| Ubuntu | commons-beanutils | pro | 1.9.3-1 | vulnerable |
| Ubuntu | commons-beanutils | pro | 1.9.3-1ubuntu0.1~esm1 | fixed |
| Opensuse | apache-commons-beanutils | leap 15.0 | 1.9.2-lp151.3.3.1 | fixed |
| Opensuse | apache-commons-beanutils | leap 15.1 | 1.9.2-lp151.3.3.1 | fixed |
| Suse | apache-commons-beanutils | linux enterprise module for web and scripting 15 | 1.9.2-4.3.1 | fixed |
| Suse | apache-commons-beanutils | linux enterprise module for web and scripting 15 sp1 | 1.9.2-4.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | commons-beanutils | source | sid | 1.9.4-1 | not yet assigned | Not reported | Not reported |
| Debian | commons-beanutils | source | forky | 1.9.4-1 | not yet assigned | Not reported | Not reported |
| Debian | commons-beanutils | source | trixie | 1.9.4-1 | not yet assigned | Not reported | Not reported |
| Debian | commons-beanutils | source | bookworm | 1.9.4-1 | not yet assigned | Not reported | Not reported |
| Suse | apache-commons-beanutils | rpm | linux enterprise server 12 sp4 | 1.9.2-3.3.1 | Not reported | SUSE-SU-2019:2244-1 | Not reported |
| Suse | apache-commons-beanutils | rpm | linux enterprise server for sap applications 12 sp4 | 1.9.2-3.3.1 | Not reported | SUSE-SU-2019:2244-1 | Not reported |
| Ubuntu | commons-beanutils | deb | pro | 1.9.3-1ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2019-10086 | Not reported |
| Opensuse | apache-commons-beanutils | rpm | leap 15.0 | 1.9.2-lp151.3.3.1 | Not reported | OPENSUSE-SU-2019:2058-1 | Not reported |
| Opensuse | apache-commons-beanutils | rpm | leap 15.1 | 1.9.2-lp151.3.3.1 | Not reported | OPENSUSE-SU-2019:2058-1 | Not reported |
| Suse | apache-commons-beanutils | rpm | linux enterprise module for web and scripting 15 | 1.9.2-4.3.1 | Not reported | SUSE-SU-2019:2245-1 | Not reported |
| Suse | apache-commons-beanutils | rpm | linux enterprise module for web and scripting 15 sp1 | 1.9.2-4.3.1 | Not reported | SUSE-SU-2019:2245-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libcommons-beanutils-java]Fixed
Source package: [commons-beanutils]
Details (2)
1.9.4-1+deb12u1· all · bookwormFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · bookworm; nvd · commons-beanutils · debian · 12
1.9.4-1+deb12u1· all · bookwormFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · bookworm; nvd · commons-beanutils · debian · 12
Source package: [commons-beanutils]
Details (2)
1.9.4-1+deb12u1· all · bookwormFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · bookworm; nvd · commons-beanutils · debian · 12
1.9.4-1+deb12u1· all · bookwormFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · bookworm; nvd · commons-beanutils · debian · 12
[Debian 13 (Trixie)]
- [libcommons-beanutils-java]Fixed
Source package: [commons-beanutils]
Details (2)
1.10.1-1.1· all · trixieFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · 13
1.10.1-1.1· all · trixieFixed · Fixed:
1.9.4-1nvd · commons-beanutils · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2020_0194.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2019-10086]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2019-10086]
- [https://osv.dev/vulnerability/DLA-1896-1]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2244-1]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2245-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-10086]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2058-1]
- [https://security-tracker.debian.org/tracker/CVE-2019-10086]
- [https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-10086.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2023-0917.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]