CVE-2019-10174
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
CVE-2019-10174- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
EUVDEUVD-2022-4059
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
EUVD-2022-4059- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h47x-2j37-fw5m
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
GHSA-h47x-2j37-fw5m- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
NVD
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
CVE-2019-10174- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-470
- Updated
- 2026-11-02
OSV
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
CVE-2019-10174- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-h47x-2j37-fw5m
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Record
GHSA-h47x-2j37-fw5m- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2024-1667
infinispan security update
Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities. At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid.
Security Fix(es):
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.(CVE-2019-10174)
- Record
OESA-2024-1667- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1092
infinispan security update
Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities. At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid.
Security Fix(es):
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan s privileges. The attacker can use reflection to introduce new, malicious behavior into the application.(CVE-2019-10174)
- Record
OESA-2025-1092- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2063
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update
- Record
RHSA-2020:2063- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:5856
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
- Record
RHSA-2024:5856- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan:infinispan-coreMaven |
through 8.2.11.Final | 8.2.12.Final |
org.infinispan:infinispan-coreMaven |
9.0.0.Final to 9.4.16.Final | 9.4.17.Final |
org.infinispan:infinispan-coreMaven |
before 8.2.12.Final, plus listed versions 5.0.0.FINAL5.0.1.FINAL5.1.0.ALPHA15.1.0.ALPHA25.1.0.BETA1 Show 45 moreShow less5.1.0.BETA25.1.0.BETA35.1.0.BETA45.1.0.BETA55.1.0.CR15.1.0.CR25.1.0.CR35.1.0.CR45.1.0.FINAL5.1.1.CR15.1.1.FINAL5.1.2.CR15.1.2.FINAL5.1.3.CR15.1.3.FINAL5.1.4.CR15.1.4.FINAL5.1.5.CR15.1.5.FINAL5.1.6.FINAL5.1.7.Final5.1.8.Final5.2.0.ALPHA15.2.0.ALPHA25.2.0.Alpha35.2.0.Alpha45.2.0.Beta15.2.0.Beta25.2.0.Beta35.2.0.Beta45.2.0.Beta55.2.0.Beta65.2.0.CR15.2.0.CR25.2.0.CR35.2.0.Final5.2.1.Final5.2.10.Final5.2.11.CR15.2.11.Final5.2.12.Final5.2.13.Final5.2.14.Final5.2.15.Final5.2.18.Final |
8.2.12.Final |
org.infinispan:infinispan-coreMaven |
9.0.0.Final up to 9.4.17.Final, plus listed versions 9.0.1.Final9.0.2.Final9.0.3.Final9.1.0.Alpha19.1.0.Beta1 Show 45 moreShow less9.1.0.CR19.1.0.Final9.1.1.Final9.1.2.Final9.1.3.Final9.1.4.Final9.1.5.Final9.1.6.Final9.1.7.Final9.2.0.Alpha19.2.0.Alpha29.2.0.Beta19.2.0.Beta29.2.0.CR19.2.0.CR29.2.0.CR39.2.0.Final9.2.1.Final9.2.2.Final9.2.3.Final9.2.4.Final9.2.5.Final9.3.0.Alpha19.3.0.Beta19.3.0.CR19.3.0.Final9.3.1.Final9.3.2.Final9.3.3.Final9.3.4.Final9.3.5.Final9.3.6.Final9.3.8.Final9.3.9.Final9.4.0.Alpha19.4.0.Beta19.4.0.CR19.4.0.CR29.4.0.CR39.4.0.Final9.4.1.Final9.4.10.Final9.4.11.Final9.4.12.Final9.4.13.Final |
9.4.17.Final |
infinispanopenEuler:20.03-LTS-SP1 |
before 8.2.4-13.oe1 | 8.2.4-13.oe1 |
infinispanopenEuler:20.03-LTS-SP4 |
before 8.2.4-13.oe2003sp4 | 8.2.4-13.oe2003sp4 |
infinispanopenEuler:22.03-LTS |
before 8.2.4-13.oe2203sp3 | 8.2.4-13.oe2203sp3 |
infinispanopenEuler:22.03-LTS-SP1 |
before 8.2.4-13.oe2203sp1 | 8.2.4-13.oe2203sp1 |
infinispanopenEuler:22.03-LTS-SP2 |
before 8.2.4-13.oe2203sp2 | 8.2.4-13.oe2203sp2 |
infinispanopenEuler:22.03-LTS-SP3 |
before 8.2.4-13.oe2203sp3 | 8.2.4-13.oe2203sp3 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
infinispanopenEuler:24.03-LTS |
before 8.2.4-13.oe2403 | 8.2.4-13.oe2403 |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:2.3.5-11.SP3_redhat_00009.1.el6eap | 0:2.3.5-11.SP3_redhat_00009.1.el6eap |
eap7-infinispanRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-cachestore-jdbcRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-cachestore-remoteRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-client-hotrodRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-commonsRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-coreRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-hibernate-cache-commonsRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-hibernate-cache-spiRed Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-infinispan-hibernate-cache-v53Red Hat:jboss_enterprise_application_platform:7.2::el6 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el6eap | 0:9.3.9-1.Final_redhat_00001.1.el6eap |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:2.3.5-11.SP3_redhat_00009.1.el7eap | 0:2.3.5-11.SP3_redhat_00009.1.el7eap |
eap7-infinispanRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-cachestore-jdbcRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-cachestore-remoteRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-client-hotrodRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-commonsRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-coreRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-hibernate-cache-commonsRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-hibernate-cache-spiRed Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-infinispan-hibernate-cache-v53Red Hat:jboss_enterprise_application_platform:7.2::el7 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el7eap | 0:9.3.9-1.Final_redhat_00001.1.el7eap |
eap7-glassfish-jsfRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:2.3.5-11.SP3_redhat_00009.1.el8eap | 0:2.3.5-11.SP3_redhat_00009.1.el8eap |
eap7-infinispanRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-cachestore-jdbcRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-cachestore-remoteRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-client-hotrodRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-commonsRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-coreRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-hibernate-cache-commonsRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-hibernate-cache-spiRed Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-infinispan-hibernate-cache-v53Red Hat:jboss_enterprise_application_platform:7.2::el8 From an advisory covering 2 CVEs |
before 0:9.3.9-1.Final_redhat_00001.1.el8eap | 0:9.3.9-1.Final_redhat_00001.1.el8eap |
eap7-apache-commons-beanutilsRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:1.9.4-1.redhat_00002.1.ep7.el7 | 0:1.9.4-1.redhat_00002.1.ep7.el7 |
eap7-infinispanRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-infinispan-cachestore-jdbcRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-infinispan-cachestore-remoteRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-infinispan-client-hotrodRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-infinispan-commonsRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-infinispan-coreRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 | 0:8.2.11-1.SP2_redhat_00001.1.ep7.el7 |
eap7-jackson-databindRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:2.8.11.5-1.redhat_00001.1.ep7.el7 | 0:2.8.11.5-1.redhat_00001.1.ep7.el7 |
eap7-log4j-jboss-logmanagerRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:1.2.2-1.Final_redhat_00002.1.ep7.el7 | 0:1.2.2-1.Final_redhat_00002.1.ep7.el7 |
eap7-nettyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:4.1.45-1.Final_redhat_00001.1.ep7.el7 | 0:4.1.45-1.Final_redhat_00001.1.ep7.el7 |
eap7-netty-allRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:4.1.45-1.Final_redhat_00001.1.ep7.el7 | 0:4.1.45-1.Final_redhat_00001.1.ep7.el7 |
eap7-undertowRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:1.4.18-12.SP12_redhat_00001.1.ep7.el7 | 0:1.4.18-12.SP12_redhat_00001.1.ep7.el7 |
eap7-wildflyRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:7.1.7-2.GA_redhat_00002.1.ep7.el7 | 0:7.1.7-2.GA_redhat_00002.1.ep7.el7 |
eap7-wildfly-elytronRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:1.1.13-1.Final_redhat_00001.1.ep7.el7 | 0:1.1.13-1.Final_redhat_00001.1.ep7.el7 |
eap7-wildfly-modulesRed Hat:jboss_enterprise_application_platform_eus:7.1::el7 From an advisory covering 21 CVEs |
before 0:7.1.7-2.GA_redhat_00002.1.ep7.el7 | 0:7.1.7-2.GA_redhat_00002.1.ep7.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10174 is a high vulnerability (CVSS 7.5) in [unknown] Infinispan, published November 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.09%, the 87th percentile. Fixed in org.infinispan:infinispan-core 8.2.12.Final.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174
access.redhat.com/errata/RHSA-2020:0481
security.netapp.com/advisory/ntap-20220210-0018
nvd.nist.gov/vuln/detail/CVE-2019-10174
github.com/infinispan/infinispan/commit/5dbb05cfaca01a1a66732b82a0f5ba615ccbd214
Show 120 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1667
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2063.json
cve.org/CVERecord?id=CVE-2018-14371
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1
issues.redhat.com/browse/JBEAP-24826
kb.cert.org/vuls/id/605641
nodejs.org/en/blog/vulnerability/aug-2019-security-releases
nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities
groups.google.com/forum
mail-archive.com/[email protected]/msg06408.html
commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt
meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert
cnvd.org.cn/webinfo/show/5415
tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
openwall.com/lists/oss-security/2021/12/13/1
Left out here: 105 versions. The JSON record has them.