{"id":"CVE-2025-48924","aliases":["AZL-65144","AZL-65181","CLSA-2025-1759709172","CLSA-2025-1759709173","CLSA-2025-1759709174","CLSA-2025-1759795575","CLSA-2025-1759795576","CLSA-2025-1764547658","CLSA-2025-1766534899","CLSA-2026-1770595751","CLSA-2026-1776040403","CLSA-2026-1783991066","CLSA-2026-1788757927","CLSA-2026-1789448501","CLSA-2026-1793128436","DEBIAN-CVE-2025-48924","DLA-4262-1","DLA-4286-1","EUVD-2025-21159","GHSA-j288-q9x7-2f5v","MGASA-2025-0293","OESA-2025-1929","OESA-2025-1971","OESA-2025-1972","OESA-2025-2030","OESA-2025-2031","OESA-2025-2032","OESA-2025-2061","RHLW-2026-5049b13f770fee17","ROOT-APP-MAVEN-CVE-2025-48924","SUSE-SU-2025:02785-1","SUSE-SU-2025:02786-1","SUSE-SU-2025:02818-1","SUSE-SU-2026:21996-1","SUSE-SU-2026:3390-1","UBUNTU-CVE-2025-48924","USN-8364-1","openSUSE-SU-2025:15347-1","openSUSE-SU-2026:10784-1","openSUSE-SU-2026:20841-1"],"status":"published","title":"Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.02632,"percentile":0.8566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-674"],"published":"2025-07-11T14:56:58Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"njawalkar/apache-commons-lang2","title":"njawalkar/apache-commons-lang2","date":"2025-10-17","url":"https://github.com/njawalkar/apache-commons-lang2"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.commons:commons-lang3","fixed_in":["3.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"apache-commons-lang3","fixed_in":["3.8.1-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"apache-commons-lang3","fixed_in":["3.8.1-6"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"commons-lang:commons-lang","fixed_in":["2.4-tuxcare.1","2.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","fixed_in":["3.4-tuxcare.1","3.10-tuxcare.1","3.12.0-tuxcare.1","3.8.1-tuxcare.1","3.17.0-tuxcare.1","3.14.0-tuxcare.1","3.11-tuxcare.1","3.15.0-tuxcare.1","3.16.0-tuxcare.1","3.9-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcommons-lang-java","fixed_in":["2.6-10+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-lang-java","fixed_in":["2.6-10+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-lang-java","fixed_in":["2.6-11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcommons-lang3-java","fixed_in":["3.12.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-lang3-java","fixed_in":["3.17.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-lang3-java","fixed_in":["3.17.0-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libcommons-lang-java","fixed_in":["2.6-9+deb11u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libcommons-lang3-java","fixed_in":["3.11-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"apache-commons-lang3","fixed_in":["3.12.0-3.1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"apache-commons-lang","fixed_in":["2.6-25.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-lang3","fixed_in":["3.18.0-1.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-lang","fixed_in":["2.6-24.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-lang","fixed_in":["2.6-24.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"apache-commons-lang","fixed_in":["2.6-24.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-lang","fixed_in":["2.6-24.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-lang","fixed_in":["2.6-24.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-lang","fixed_in":["2.6-24.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.commons:commons-lang3","fixed_in":["3.17.0.rhlw-00011"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.commons:commons-lang3","fixed_in":["3.12.0-root.io.1","3.9-root.io.1","3.12.0-root.io.2","3.9-root.io.2","3.9-root.io.3","3.12.0-root.io.3","3.12.0-root.io.4","3.9-root.io.4","3.8.1-root.io.1","3.16.0-root.io.1","3.17.0-root.io.1","3.14.0-root.io.1","3.13.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.commons:commons-lang3","fixed_in":["3.12.0-aikido.4","3.9-aikido.4","3.8.1-aikido.1","3.16.0-aikido.1","3.17.0-aikido.1","3.14.0-aikido.1","3.13.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.commons-lang:commons-lang","fixed_in":["2.4-root.io.1","2.6-root.io.1","2.6-root.io.2","2.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"commons-lang:commons-lang","fixed_in":["2.4-aikido.1","2.6-aikido.1","2.6-aikido.2","2.4-aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache-commons-lang","fixed_in":["2.6-150200.14.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-lang","fixed_in":["2.6-150200.14.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-lang","fixed_in":["2.6-150200.14.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache-commons-lang","fixed_in":["2.6-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache-commons-lang3","fixed_in":["3.18.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-lang3","fixed_in":["3.18.0-150200.3.12.1","3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"apache-commons-lang3","fixed_in":["3.18.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-lang3","fixed_in":["3.18.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache-commons-compress","fixed_in":["1.28.0-150200.3.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache-commons-lang3","fixed_in":["3.20.0-150200.3.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"beust-jcommander","fixed_in":["1.83-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"google-guice","fixed_in":["6.0.0-150200.3.13.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"guava","fixed_in":["33.2.1-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jansi","fixed_in":["2.4.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"maven","fixed_in":["3.9.16-150200.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"maven-resolver","fixed_in":["1.9.27-150200.3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"plexus-interpolation","fixed_in":["1.27.0-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"plexus-xml","fixed_in":["3.0.1-150200.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-connector","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-mojo","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-tools","fixed_in":["4.3.0-150200.3.30.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-3ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.2.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-6ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-8ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.8-1~18.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-9ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.8-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-9ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.11-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-lang-java","fixed_in":["2.6-10ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libcommons-lang3-java","fixed_in":["3.14.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-lang3","fixed_in":["3.18.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.18.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"last_affected":"2.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-6"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4"},{"fixed":"2.4-tuxcare.1"}]}],"versions":["2.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6"},{"fixed":"2.6-tuxcare.1"}]}],"versions":["2.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4"},{"fixed":"3.4-tuxcare.1"}]}],"versions":["3.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10"},{"fixed":"3.10-tuxcare.1"}]}],"versions":["3.10"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.12.0-tuxcare.1"}]}],"versions":["3.12.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1"},{"fixed":"3.8.1-tuxcare.1"}]}],"versions":["3.8.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.17.0-tuxcare.1"}]}],"versions":["3.17.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.0"},{"fixed":"3.14.0-tuxcare.1"}]}],"versions":["3.14.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11"},{"fixed":"3.11-tuxcare.1"}]}],"versions":["3.11"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.0"},{"fixed":"3.15.0-tuxcare.1"}]}],"versions":["3.15.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"3.16.0-tuxcare.1"}]}],"versions":["3.16.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9"},{"fixed":"3.9-tuxcare.1"}]}],"versions":["3.9"]},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-10+deb12u1"}]}],"versions":["2.6-10"]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-10+deb13u1"}]}],"versions":["2.6-10"]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-11"}]}],"versions":["2.6-10"]},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-2+deb12u1"}]}],"versions":["3.12.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.0-1+deb13u1"}]}],"versions":["3.17.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.0-2"}]}],"versions":["3.17.0-1"]},{"source":"osv","ecosystem":"Debian:11","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-9+deb11u1"}]}],"versions":["2.6-9"]},{"source":"osv","ecosystem":"Debian:11","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11-1+deb11u1"}]}],"versions":["3.11-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.18.0"}]}],"versions":["3.0","3.0.1","3.1","3.10","3.11","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.2","3.2.1","3.3","3.3.1","3.3.2","3.4","3.5","3.6","3.7","3.8","3.8.1","3.9"]},{"source":"osv","ecosystem":"Maven","package":"commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"last_affected":"2.6"}]}],"versions":["2.0","2.1","2.2","2.3","2.4","2.5","2.6"]},{"source":"osv","ecosystem":"Mageia:9","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-3.1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-25.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-24.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.0.rhlw-00011"}]}],"versions":["3.0","3.0.1","3.1","3.10","3.11","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.2","3.2.1","3.3","3.3.1","3.3.2","3.4","3.5","3.6","3.7","3.8","3.8.1","3.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-root.io.1"},{"fixed":"3.9-root.io.1"},{"fixed":"3.12.0-root.io.2"},{"fixed":"3.9-root.io.2"},{"fixed":"3.9-root.io.3"},{"fixed":"3.12.0-root.io.3"},{"fixed":"3.12.0-root.io.4"},{"fixed":"3.9-root.io.4"},{"fixed":"3.8.1-root.io.1"},{"fixed":"3.16.0-root.io.1"},{"fixed":"3.17.0-root.io.1"},{"fixed":"3.14.0-root.io.1"},{"fixed":"3.13.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.commons:commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-aikido.4"},{"fixed":"3.9-aikido.4"},{"fixed":"3.8.1-aikido.1"},{"fixed":"3.16.0-aikido.1"},{"fixed":"3.17.0-aikido.1"},{"fixed":"3.14.0-aikido.1"},{"fixed":"3.13.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-root.io.1"},{"fixed":"2.6-root.io.1"},{"fixed":"2.6-root.io.2"},{"fixed":"2.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"commons-lang:commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-aikido.1"},{"fixed":"2.6-aikido.1"},{"fixed":"2.6-aikido.2"},{"fixed":"2.4-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-150200.14.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-150200.14.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-150200.14.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"apache-commons-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-configuration2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apache-commons-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-configuration2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apache-commons-text","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache-commons-compress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-150200.3.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-150200.3.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"beust-jcommander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"google-guice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-150200.3.13.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"33.2.1-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jansi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.16-150200.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"maven-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27-150200.3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"plexus-interpolation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"plexus-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150200.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-mojo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xmvn-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150200.3.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-3ubuntu2+esm1"}]}],"versions":["2.6-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1ubuntu0.1~esm1"}]}],"versions":["3.1-1","3.1-2","3.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-6ubuntu2+esm1"}]}],"versions":["2.6-5ubuntu1","2.6-6ubuntu1","2.6-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-1ubuntu0.1~esm1"}]}],"versions":["3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-8ubuntu0.1~esm1"}]}],"versions":["2.6-6ubuntu3","2.6-7","2.6-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-1~18.04.2+esm1"}]}],"versions":["3.5-1","3.5-2ubuntu1","3.8-1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-9ubuntu0.20.04.1~esm1"}]}],"versions":["2.6-8","2.6-9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-2ubuntu0.1~esm1"}]}],"versions":["3.8-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-9ubuntu0.22.04.1"}]}],"versions":["2.6-9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11-1ubuntu0.1"}]}],"versions":["3.11-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-10ubuntu0.1"}]}],"versions":["2.6-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-1ubuntu0.1~esm1"}]}],"versions":["3.12.0-2","3.13.0-1","3.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-3ubuntu2+esm1"}]}],"versions":["2.6-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1ubuntu0.1~esm1"}]}],"versions":["3.1-1","3.1-2","3.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-6ubuntu2+esm1"}]}],"versions":["2.6-5ubuntu1","2.6-6ubuntu1","2.6-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-1ubuntu0.1~esm1"}]}],"versions":["3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-8ubuntu0.1~esm1"}]}],"versions":["2.6-6ubuntu3","2.6-7","2.6-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-1~18.04.2+esm1"}]}],"versions":["3.5-1","3.5-2ubuntu1","3.8-1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-9ubuntu0.20.04.1~esm1"}]}],"versions":["2.6-8","2.6-9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-2ubuntu0.1~esm1"}]}],"versions":["3.8-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-9ubuntu0.22.04.1"}]}],"versions":["2.6-9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11-1ubuntu0.1"}]}],"versions":["3.11-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-lang-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-10ubuntu0.1"}]}],"versions":["2.6-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libcommons-lang3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-1ubuntu0.1~esm1"}]}],"versions":["3.12.0-2","3.13.0-1","3.14.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-configuration2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"commons_lang"},{"vendor":"apache software foundation","product":"apache commons lang"}],"references":[{"url":"https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00032.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00026.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00000.html","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/11/1","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00036.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48924","tags":["web","advisory"]},{"url":"https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j288-q9x7-2f5v","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48924.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48924","tags":["advisory"]},{"url":"https://github.com/apache/commons-lang","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0293.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34483","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/11/1","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1929","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1971","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1972","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2030","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2031","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2032","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2061","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502785-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246397","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48924","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1085999","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502818-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621996-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265299","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45205","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263390-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48924","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8364-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48924","title":"Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T14:56:58.049Z","modified":"2025-11-04T22:06:40.023Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-21159","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T14:56:58Z","modified":"2025-11-04T22:06:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-j288-q9x7-2f5v","title":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:31:37Z","modified":"2025-11-05T20:30:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:39:07.0252Z"}],"nvd":[{"id":"CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:15:24.347Z","modified":"2026-06-17T09:30:29.473Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:11:18.285862Z"}],"osv":[{"id":"CVE-2025-48924","title":"Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T14:56:58.049Z","modified":"2026-10-28T02:30:51.287016889Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.  This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.  The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a  StackOverflowError could cause an application to stop.  Users are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:15:24.347Z","modified":"2026-09-01T20:05:54.515963005Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-j288-q9x7-2f5v","title":"Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:31:37Z","modified":"2026-09-10T03:50:26.17691227Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"OESA-2025-1929","title":"apache-commons-lang3 security update","description":"The standard Java libraries fail to provide enough methods for manipulation of its core classes. The Commons Lang Component provides these extra methods. Lang provides a host of helper utilities for the java.lang API, notably String manipulation methods, basic numerical methods, object reflection, concurrency, creation and serialization and System properties. Additionally it contains basic enhancements to java.util.Date and a series of utilities dedicated to help with building methods, such as hashCode, toString and equals. Note that Lang 3.0 (and subsequent versions) use a different package (org.apache.commons.lang3) than the previous versions (org.apache.commons.lang), allowing it to be used at the same time as an earlier version.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:34.612417301Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1971","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:57.156114255Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1972","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:57.196895895Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2030","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-15T11:09:06Z","modified":"2026-08-18T01:18:02.975015371Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2031","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-15T11:09:07Z","modified":"2026-08-18T01:18:02.953231825Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2032","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-15T11:09:07Z","modified":"2026-08-18T01:18:02.941710799Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2061","title":"apache-commons-lang security update","description":"The standard Java libraries fail to provide enough methods for manipulation of  its core classes. Apache Commons Lang provides these extra methods.\r\n\r\nSecurity Fix(es):\n\nA vulnerability classified as problematic has been found in Apache Commons Lang up to 2.6/3.17.x.CWE is classifying the issue as CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 3.18.0 eliminates this vulnerability.(CVE-2025-48924)","status":"published","published":"2025-08-22T11:09:08Z","modified":"2026-08-18T01:18:57.932135239Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHLW-2026-5049b13f770fee17","title":"Lightwell Security Advisory: commons-lang3 3.17.0.rhlw-00011","description":"Red Hat Lightwell has released org.apache.commons:commons-lang3 3.17.0.rhlw-00011 with a backported security fix.\n\nCVE-2025-48924: Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs\n\nThis patched artifact is a drop-in replacement for org.apache.commons:commons-lang3 3.17.0 from Maven Central.","status":"published","published":"2026-09-15T21:04:37Z","modified":"2026-10-27T04:00:10.732090941Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-48924","title":"CVE-2025-48924 in io.root.org.apache.commons:commons-lang3 - Patched by Root","description":"Root has patched CVE-2025-48924 in the io.root.org.apache.commons:commons-lang3 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-02T12:24:44Z","modified":"2026-08-02T19:00:04.444004362Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-48924","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:15:00Z","modified":"2026-06-02T18:15:29.203286975Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-65144","title":"CVE-2025-48924 affecting package apache-commons-lang3 for versions less than 3.8.1-6","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:15:24Z","modified":"2026-04-21T04:37:30.811212Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65181","title":"CVE-2025-48924 affecting package apache-commons-lang3 for versions less than 3.8.1-6","description":"Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.","status":"published","published":"2025-07-11T15:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"CLSA-2025-1759709172","title":"TuxCare security update for commons-lang:commons-lang (1 CVE)","description":"TuxCare rebuilt commons-lang:commons-lang to address 1 CVE. Fixed in 2.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:10.625581355Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759709173","title":"TuxCare security update for commons-lang:commons-lang (1 CVE)","description":"TuxCare rebuilt commons-lang:commons-lang to address 1 CVE. Fixed in 2.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:11.578673939Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759709174","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:45:08.278419873Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759795575","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:10.169205993Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1759795576","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.12.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:46:11.029920055Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1764547658","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.8.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-10-15T09:46:13.14757518Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2025-1766534899","title":"TuxCare security update for org.apache.maven (1 CVE)","description":"TuxCare rebuilt 15 org.apache.maven packages to address 1 CVE. Fixed in 3.8.1-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:06Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1770595751","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.17.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:46:09.91502164Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776040403","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.14.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:25.756856453Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1783991066","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:29.64616455Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1788757927","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1.","status":"published","published":"2026-09-07T05:12:07Z","modified":"2026-10-15T09:46:55.109417306Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789448501","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.16.0-tuxcare.1.","status":"published","published":"2026-09-15T05:01:41Z","modified":"2026-10-15T09:47:44.11064361Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1793128436","title":"TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)","description":"TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.9-tuxcare.1.","status":"published","published":"2026-10-27T19:13:56Z","modified":"2026-10-28T01:45:04.501604986Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"DLA-4262-1","title":"libcommons-lang-java - security update","status":"published","published":"2025-08-01T00:00:00Z","modified":"2026-03-09T02:08:37.241018Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DLA-4286-1","title":"libcommons-lang3-java - security update","status":"published","published":"2025-08-31T00:00:00Z","modified":"2026-03-09T02:11:37.010341Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0293","title":"Updated apache-commons-lang3 \u0026 apache-commons-lang packages fix security vulnerability","description":"Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can\nthrow a StackOverflowError on very long inputs. (CVE-2025-48924)\n","status":"published","published":"2025-11-15T07:11:33Z","modified":"2026-04-16T04:43:49.351837077Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15347-1","title":"apache-commons-lang3-3.18.0-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-lang3-3.18.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-16T00:00:00Z","modified":"2026-03-23T04:53:39.814763Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:10784-1","title":"apache-commons-configuration2-2.15.0-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-configuration2-2.15.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.736483Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20841-1","title":"Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec","description":"This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:\n\nChanges in apache-commons-lang3:\n\nUpdate to 3.20.0\n\n  * New features:\n\n    + Add SystemProperties.getPath(String, Supplier\u003cPath\u003e)\n    + Add JavaVersion.JAVA_25\n    + Add JavaVersion.JAVA_26\n    + Add SystemUtils.IS_JAVA_25\n    + Add SystemUtils.IS_JAVA_26\n    + Add MutablePair.ofNonNull(Map.Entry)\n    + Add TimedSemaphore.builder(), Builder, and deprecate\n      constructors\n    + LANG-1504: Adding labels and history to split StopWatch\n\n  * Fixed Bugs:\n\n    + Optimize ObjectToStringComparator.compare() method\n    + [javadoc] Improve StringUtils Javadoc\n    + Fix internal inverted logic in private isEnum() method and\n      correct its usage in getFirstEnum()\n    + Use accessors in ToStringStyle so subclasses can effectively\n      override them\n    + 'LocaleUtils.toLocale(String)' for a 2 letter country code\n      now returns a value instead of throwing an\n      'IllegalArgumentException'\n    + Fix typo in StringUtils.trunctate() IllegalArgumentException\n      message and test assertion messages\n    + Fix test fixture in\n      ReflectionDiffBuilderTest.testTransientFieldDifference()\n    + LANG-1789: NullPointerException when generating\n      NoSuchMethodException in MethodUtils\n    + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE\n      WARNINGs to the console\n    + LANG-1792: TypeUtils.toString() skips angle brackets for Class\n      type\n    + Mention JDK 25 LTS as a tested version in the release notes\n  * Changes:\n    + Bump org.apache.commons:commons-parent from 88 to 92\n\n- Update to 3.19.0\n\n  * New features:\n\n    + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH\n    + Add SystemUtils.IS_OS_NETWARE\n    + Add MethodUtils.getAccessibleMethod(Class, Method)\n    + Add documentation to site for CVE-2025-48924\n      ClassUtils.getClass(...) can throw a StackOverflowError on\n      very long inputs\n    + Add StringUtils.indexOfAny(CharSequence, int, char...)\n    + Add ConcurrentException.ConcurrentException(String)\n    + Add DateUtils.toLocalDateTime(Date[, TimeZone])\n    + Add DateUtils.toOffsetDateTime(Date[, TimeZone])\n    + Add DateUtils.toZonedDateTime(Date[, TimeZone])\n    + Add ByteConsumer\n    + Add ByteSupplier\n    + Add FailableByteConsumer\n    + Add FailableByteSupplier\n    + LANG-1784: Add Functions methods for null-safe mapping and\n      chaining\n    + LANG-1784: Add Failable methods for null-safe mapping and\n      chaining\n    + Add DoubleRange.fit(double)\n    + Add IntegerRange.fit(int)\n    + Add LongRange.fit(long)\n    + Add DurationUtils.get(String, TemporalUnit, long)\n    + Add DurationUtils.getMillis(String, long)\n    + Add DurationUtils.getSeconds(String, long)\n    + Add SystemProperties.getBoolean(Class, String, boolean)\n    + Add SystemProperties.getInt(Class, String, int)\n    + Add SystemProperties.getLong(Class, String, long)\n\n  * Fixed Bugs:\n\n    + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the\n      hierarchy of methods\n    + MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...) now\n      returns null instead of throwing a NullPointerException, as it\n      does for other exception types\n    + Reduce spurious failures in ArrayUtilsTest methods that test\n      ArrayUtils.shuffle() methods\n    + MethodUtils cannot find or invoke a public method on a public\n      class implemented in its package-private superclass\n    + AtomicSafeInitializer.get() can spin internally if the\n      FailableSupplier given to AbstractConcurrentInitializer\n      .AbstractBuilder.setInitializer(FailableSupplier) throws a\n      RuntimeException\n    + LANG-1783: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + LANG-1782: MethodUtils cannot find or invoke vararg methods\n      without providing vararg types or values\n    + MethodUtils cannot find or invoke vararg methods of interface\n      types\n    + MethodUtils cannot find or invoke vararg methods when widening\n      primitive types following the JLS 5.1.2. Widening Primitive\n      Conversion\n    + LANG-1597: Invocation fails because matching varargs method\n      found but then discarded\n    + Don't check accessibility twice in MemberUtils\n      .setAccessibleWorkaround(T)\n    + LANG-1774: Improve handling of ClassUtils\n      .getShortCanonicalName() for invalid input\n    + LANG-1720: Improve Javadocs for Conversion\n    + Fix CalendarUtils.toLocalDate() Javadoc return type\n      description\n    + Fix the method name in Javadoc examples for CharUtils.isHex()\n    + Deprecate NumberUtils.compare(byte, byte) in favor of\n      Byte.compare(byte, byte)\n    + Deprecate NumberUtils.compare(int, int) in favor of\n      Integer.compare(int, int)\n    + Deprecate NumberUtils.compare(long, long) in favor of\n      Long.compare(long, long)\n    + Deprecate NumberUtils.compare(short, short) in favor of\n      Short.compare(short, short)\n    + Deprecate obsolete system property constant\n      SystemProperties.AWT_TOOLKIT\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_FONTS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_GRAPHICSENV\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_HEADLESS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_PRINTERJOB\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_COMPILER\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_ENDORSED_DIRS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_EXT_DIRS\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getAwtToolkit()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtFonts()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtGraphicsenv()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtHeadless()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtPrinterjob()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaCompiler()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaEndorsedDirs()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaExtDirs()\n    + Deprecate method for obsolete system property constant\n      SystemUtils.isJavaAwtHeadless()\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_FONTS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_GRAPHICSENV\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_HEADLESS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_PRINTERJOB\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_COMPILER\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_ENDORSED_DIRS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_EXT_DIRS\n    + [javadoc] General improvements\n    + [javadoc] Fix thrown exception documentation for\n      MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...)\n    + [javadoc] Strings::equalsAny: CI doc string should show it's\n      insensitive\n    + [javadoc] General Javadoc improvements\n    + LANG-1780: [javadoc] Fix Strings Javadoc\n    + [javadoc] Fix typo in Javadoc of Strings instances\n    + [javadoc] Fix Javadocs in ClassUtils\n    + [javadoc] Fix @deprecated link for StringUtils#startsWithAny\n    + Replace old feather logotype with new oak logotype\n  * Changes:\n    + [test] Bump org.apache.commons:commons-text from 1.13.1 to\n      1.14.0\n    + Bump org.apache.commons:commons-parent from 85 to 88\n\n- Update to 3.18.0\n\n- Fix component version in default.properties to 3.12\n\n    * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.\n    * Add FailableShortSupplier, handy for JDBC APIs.\n    * Add JavaVersion.JAVA_17.\n    * Add StringUtils.substringBefore(String, int).\n    * Add Range.INTEGER.\n    * Add DurationUtils.\n    * Correct implementation of RandomUtils.nextLong(long, long).\n    * Update maven-surefire-plugin 2.22.2 -\u003e 3.0.0-M5.\n    * Bump junit-bom from 5.7.0 to 5.7.1.\n    * Ignored exception 'ignored', should not be called so.\n    * Change array style from 'int a[]' to 'int[] a'.\n\nChanges in apache-commons-text:\n\n- Upgrade to version 1.15.0\n\n  * New features\n\n    + Add experimental CycloneDX VEX file\n    + TEXT-235: Add Damerau-Levenshtein distance\n    + Add unit tests to increase coverage\n    + Add new test for CharSequenceTranslator#with()\n    + Add tests and assertions to org.apache.commons.text.similarity\n      to get to 100% code coverage\n\n  * Fixed Bugs\n\n    + Fix exception message typo in XmlStringLookup\n      .XmlStringLookup(Map, Path...)\n    + TEXT-236: Inserting at the end of a TextStringBuilder throws\n      a StringIndexOutOfBoundsException\n    + Fix TextStringBuilderTest.testAppendToCharBuffer() to use\n      proper argument type\n    + Fix Apache RAT plugin console warnings\n    + Fix site XML to use version 2.0.0 XML schema\n    + Removed unreachable threshold verification code in\n      src/main/java/org/apache/commons/text/similarity\n    + Enable secure processing for the XML parser in XmlStringLookup\n      in case the underlying JAXP implementation doesn't\n\n- Upgrade to version 1.14.0\n\n  * New features\n\n    + Interface StringLookup now extends UnaryOperator\u003cString\u003e\n    + Interface TextRandomProvider extends IntUnaryOperator\n    + Add RandomStringGenerator.Builder\n      .usingRandom(IntUnaryOperator)\n    + Add PMD check to default Maven goal\n    + Add org.apache.commons.text.RandomStringGenerator.Builder\n      .setAccumulate(boolean)\n\n  * Fixed Bugs\n\n    + Fix PMD UnnecessaryFullyQualifiedName in StringLookupFactory\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      DefaultStringLookupsHolder\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      PropertiesStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      JavaPlatformStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in StringSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in StrSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in AlphabetConverter\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in\n      TextStringBuilder\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in StrBuilder\n    + org.apache.commons.text.translate.LookupTranslator\n      .LookupTranslator(Map CharSequence\u003e) now throws\n      NullPointerException instead of\n      java.security.InvalidParameterException\n\n- Upgrade to version 1.13.1\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Deprecate EntityArrays.EntityArrays()\n    + StringLookupFactory.DefaultStringLookupsHolder\n      .createDefaultStringLookups() maps DefaultStringLookup\n      .LOCAL_HOST twice instead of once for LOCAL_HOST and\n      LOOPBACK_ADDRESS\n\n- Upgrade to version 1.13.0\n\n  * New features\n\n    + Add StringLookupFactory.loopbackAddressStringLookup()\n    + Add StringLookupFactory.KEY_LOOPBACK_ADDRESS\n    + Add DefaultStringLookup.LOOPBACK_ADDRESS\n    + Add richer inputs in package org.apache.commons.text\n      .similarity with SimilarityInput\n    + Add HammingDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardSimilarity.apply(SimilarityInput, SimilarityInput)\n    + Add JaroWinklerDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add JaroWinklerSimilarity.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDetailedDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDistance.apply(SimilarityInput,\n      SimilarityInput)\n\n  * Fixed Bugs\n\n    + Fix build on Java 22\n    + Fix build on Java 23-ea\n    + Make package-private constructor private:\n      StrLookup.MapStrLookup.MapStrLookup(Map)\n    + Make package-private constructor private: StrLookup\n      .SystemPropertiesStrLookup.SystemPropertiesStrLookup()\n    + Make package-private class private and final: MapStrLookup\n    + Make package-private class private: StrMatcher.CharMatcher\n    + Make package-private class private: StrMatcher.CharSetMatcher\n    + Make package-private class private: StrMatcher.NoMatcher\n    + Make package-private class private: StrMatcher.StringMatcher\n    + Make package-private class private: StrMatcher.TrimMatcher\n    + Make package-private class private and final:\n      IntersectionSimilarity.BagCount\n    + Make package-private class private and final:\n      IntersectionSimilarity.TinyCount\n    + Deprecate LevenshteinDistance.LevenshteinDistance() in favor\n      of LevenshteinDistance.getDefaultInstance()\n    + Deprecate LevenshteinDetailedDistance\n      .LevenshteinDetailedDistance() in favor of\n      LevenshteinDetailedDistance.getDefaultInstance()\n    + TEXT-234: Improve StrBuilder documentation for new line text\n    + TEXT-234: Improve TextStringBuilder documentation for new line\n      text\n    + TEXT-233: Required OSGi Import-Package version numbers in\n      MANIFEST.MF\n\n- Upgrade to version 1.12.0\n\n  * New features\n\n    + Add StringLookupFactory.fileStringLookup(Path...) and\n      deprecated fileStringLookup()\n    + Add StringLookupFactory.propertiesStringLookup(Path...) and\n      deprecated propertiesStringLookup()\n    + Add StringLookupFactory.xmlStringLookup(Map, Path...) and\n      deprecated xmlStringLookup() and xmlStringLookup(Map)\n    + Add StringLookupFactory.builder() for fencing Path resolution\n      of the file, properties and XML lookups\n    + Add DoubleFormat.Builder.get() as Builder now implements\n      Supplier\n\n  * Fixed Bugs\n\n    + TEXT-232: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + TEXT-175: Fix regression for determining whitespace in\n      WordUtils\n    + Deprecate Builder in favor of Supplier\n\n- Upgrade to version 1.11.0\n\n  * New features\n\n    + TEXT-224: Set SecureProcessing feature in XmlStringLookup by\n      default\n    + TEXT-224: Add StringLookupFactory.xmlStringLookup(Map\u003cString,\n      Boolean\u003e...)\n    + Add @FunctionalInterface to FormatFactory\n    + Add RandomStringGenerator.builder()\n    + TEXT-229: Add XmlEncoderStringLookup/XmlDecoderStringLookup\n    + Add StringSubstitutor.toString()\n\n  * Fixed Bugs\n\n    + TEXT-219: Fix StringTokenizer.getTokenList to return an\n      independent modifiable list\n    + Fix Javadoc for StringEscapeUtils.escapeHtml4\n    + TextStringBuidler#hashCode() allocates a String on each call\n    + TEXT-221: Fix Bundle-SymbolicName to use the package name\n      org.apache.commons.text\n    + Add and use a package-private singleton for RegexTokenizer\n    + Add and use a package-private singleton for CosineSimilarity\n    + Add and use a package-private singleton for\n      LongestCommonSubsequence\n    + Add and use a package-private singleton for\n      JaroWinklerSimilarity\n    + Add and use a package-private singleton for JaccardSimilarity\n    + [StepSecurity] ci: Harden GitHub Actions\n    + Improve AlphabetConverter Javadoc\n    + Fix exception message in IntersectionResult to make\n      set-theoretic sense\n    + Add null-check in RandomStringGenerator#Builder#selectFrom()\n      to avoid NullPointerException\n    + Add null-check in RandomStringGenerator#Builder#withinRange()\n      to avoid NullPointerException\n    + TEXT-228: Fix TextStringBuilder to over-allocate when ensuring\n      capacity\n    + Constructor for ResourceBundleStringLookup should be private\n      instead of package-private\n    + Constructor for UrlDecoderStringLookup should be private\n      instead of package-private\n    + Constructor for UrlEncoderStringLookup should be private\n      instead of package-private\n    + TEXT-230: Javadoc of org.apache.commons.text.lookup\n      .DefaultStringLookup.XML is incorrect\n    + Update DoubleFormat to state it is based on Double.toString\n\n    + Removed non-existing parameter from Javadocs and spelled out\n    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin\n    + Refactor TextStringBuilder.readFrom(Readable), extracting\n    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,\n    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],\n\nChanges in apache-commons-configuration2:\n\n- Upgrade to version 2.15.0\n\n  * Changes\n\n    + Disable include schemes http[s] by default, see\n      AbstractFileLocationStrategy\n    + Detect and avoid processing cycles in YAML input\n      (YAMLConfiguration) (bsc#1265299, CVE-2026-45205)\n    + Extend scheme validation to inner schemes of jar: URLs\n\n- Upgrade to version 2.14.0\n\n  * New features\n\n    + Add XMLConfiguration.read(Element)\n    + Add ConfigurationException.ConfigurationException(String,\n      Object...)\n    + Add ConfigurationException.ConfigurationException(Throwable,\n      String, Object...)\n    + Add ConversionException.ConversionException(String, Object...)\n    + Add ConversionException.ConversionException(Throwable, String,\n      Object...)\n    + Add ConfigurationRuntimeException\n      .ConfigurationRuntimeException(Throwable, String, Object...)\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + Migrate from deprecated APIs\n\n- Upgrade to version 2.13.0\n\n  * New features\n\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .entrySet()\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .forEach(BiConsumer\u003cString, Object\u003e)\n    + Add VEX entry for CVE-2025-48924\n\n  * Fixed Bugs\n\n    + Shared primitive variable \"throwExceptionOnMissing\" in one\n      thread may not yield the value of the most recent write from\n      another thread [org.apache.commons.configuration2\n      .AbstractConfiguration] At AbstractConfiguration.java:\n      [line 1493] AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + Shared primitive variable \"forceSingleLine\" in one thread may\n      not yield the value of the most recent write from another\n      thread [org.apache.commons.configuration2\n      .PropertiesConfigurationLayout]\n      At PropertiesConfigurationLayout.java:[line 821]\n      AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + CONFIGURATION-849: Fix undoubling of strings\n    + CONFIGURATION-852: Mark the package jakarta.servlet.* import\n      as optional in OSGi\n    + Fix build [WARNING] Parameter 'forkMode' is unknown for plugin\n      'maven-surefire-plugin:3.5.3:test (default-test)'\n\n- Upgrade to version 2.12.0\n\n  * New features:\n\n    + Add PrefixedKeysIterator.toString() to package-private\n      PrefixedKeysIterator\n    + CONFIGURATION-836: New web configurations using the\n      jakarta.servlet namespace are now available\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletContextConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletFilterConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletRequestConfiguration\n    + Add org.apache.commons.configuration2\n      .AbstractHierarchicalConfiguration.getKeysInternal(String,\n      String)\n\n  * Fixed Bugs:\n\n    + PropertyConverter.to(Class, Object, DefaultConversionHandler)\n      doesn't convert custom java.lang.Number subclasses\n    + DefaultConversionHandler.convertValue(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + DefaultConversionHandler.to(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + CONFIGURATION-848: SubsetConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + CONFIGURATION-848: CompositeConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + Describe the security model\n    + De-emphasize the 1.x version line on the website\n    + CONFIGURATION-851: HomeDirectoryLocationStrategy no longer\n      resolves the user HOME directory correctly\n\n- Upgrade to version 2.11.0\n\n  * New features\n\n    + CONFIGURATION-844: Add support for empty sections\n    + Add ImmutableConfiguration.containsValue(Object)\n\n  * Fixed Bugs\n\n    + Fail-fast with a NullPointerException if DataConfiguration\n      .DataConfiguration(Configuration) is called with null\n    + Fail-fast with a NullPointerException if\n      XMLPropertiesConfiguration.XMLPropertiesConfiguration(Element)\n      is called with null\n    + Fail-fast with a NullPointerException if a SubsetConfiguration\n      constructor is called with a null Configuration\n    + CONFIGURATION-843: Methods should not be empty\n    + Guard MapConfiguration against null maps\n    + Fail-fast with a NullPointerException if\n      AppletConfiguration(Applet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(ServletConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(ServletContext) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletFilterConfiguration(FilterConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletRequestConfiguration(ServletRequest) is called with\n      null\n    + Deprecate DatabaseConfiguration.getDatasource() in favor of\n      getDataSource()\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractImmutableNodeHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractListDelimiterHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      DefaultPrefixLookupsHolder\n    + Fix PMD DynamicCombinedConfiguration in\n      DynamicCombinedConfiguration\n    + Fix PMD DynamicCombinedConfiguration in\n      PropertiesConfiguration\n    + CONFIGURATION-846: Restore previous behavior allowing Spring\n      to inject multiple values\n    + CONFIGURATION-847: Property with an empty string value was not\n      processed\n\nChanges in apache-commons-cli:\n\n- Update to 1.11.0\n\n  * New Features\n\n    + Add CommandLine.getOptionCount() to measure option repetition\n\n  * Fixed Bugs\n\n    + CLI-351: Multiple trailing BREAK_CHAR_SET characters cause\n      infinite loop in HelpFormatter\n    + CLI-351:  Fix issue with groups not being reported in help\n      output\n\nChanges in apache-commons-io:\n\n- Upgrade to 2.22.0\n\n  * New features\n\n    + Add and use IOUtils.closeQuietlySuppress(Closeable, Throwable)\n    + Add ProxyWriter.setReference(Writer)\n    + Add ProxyWriter.unwrap()\n    + Add ProxyReader.setReference(Reader)\n    +Add ProxyReader.unrwap()\n    + IO-883: ByteArraySeekableByteChannel should optionally\n      configure a read-only channel\n    + IO-883: Add ByteArraySeekableByteChannel.Builder and builder()\n    + IO-883: Add AbstractStreamBuilder.getByteArray()\n    + CloseShieldInputStream now supports a custom close shield as\n      a function\n    + Add FlushShieldOutputStream to workaround issues in generic\n      code that ends up calling third parties like like\n      org.tukaani.xz.LZMAOutputStream.flush()\n    + Add filter channels\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + ByteArraySeekableByteChannel.position(long) and truncate(long)\n      shouldn't throw an IllegalArgumentException for a new positive\n      position that's too large\n    + Fix malformed Javadoc comments\n    + ReadAheadInputStream.close() doesn't always close its filtered\n      input stream\n    + ReadAheadInputStream now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + FileAlterationMonitor.stop(long) now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + FileCleaningTracker now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThreadMonitor.run() now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() doesn't preserve the original\n      InterruptedException as the cause of its\n      InterruptedIOException\n    + All thread names are now prefixed with \"commons-io-\"\n    + IO-639: ReversedLinesFileReader does not read first line if\n      its empty\n    + IO-886: Fixed incorrect regular expression in\n      PathUtils.RelativeSortedPaths.extractKey(String, String)\n    + Fix typos in Javadoc of FileUtils and related test classes\n    + IO-887: WriterOutputStream from a builder fails on malformed\n      or unmappable input bytes\n    + BoundedReader now extends ProxyReader\n    + AbstractStreamBuilder.setOpenOptions(OpenOption...) now makes\n      a defensive copy of its input array\n    + IO-885: Path visits follow links\n    + BOMInputStream fail-fast and tracks its ByteOrderMark as a final\n    + Refactor UnixLineEndingInputStream and\n      WindowsLineEndingInputStream for duplication\n    + IO-857: [Javadoc] PathUtils.cleanDirectory() methods vs FileUtils\n    + Fix JaCoCo report generation (code coverage)\n    + AbstractStreamBuilder.setBufferSizeDefault(int) now resets to\n      default for input less than or equal to zero\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 91 to 98\n    + Bump commons-codec:commons-codec from 1.19.0 to 1.21.0\n    + Bump commons.bytebuddy.version from 1.17.8 to 1.18.8\n    + Bump commons-lang3 from 3.19.0 to 3.20.0\n\nChanges in apache-commons-codec:\n\n- Update to 1.22.0\n\n  * New features\n\n    + CODEC-326: Add Base58 support\n    + Add BaseNCodecInputStream.AbstracBuilder.setByteArray(byte[])\n    + CODEC-335: Add GitIdentifiers to compute Git blob and tree\n      object identifiers\n\n  * Fixed Bugs\n\n    + CODEC-249: Fix Incorrect transform of CH digraph according\n      Metaphone basic rules #423\n    + CODEC-317: ColognePhonetic can create duplicate consecutive\n      codes in some cases\n    + Add boundary tests for BinaryCodec.fromAscii partial-bit\n      inputs #425\n    + CODEC-336: Base64.Builder.setUrlSafe(boolean) Javadoc\n      incorrectly states null is accepted for primitive boolean\n      parameter\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 96 to 98\n\n- Update to 1.21.0\n\n  * New features\n\n    + CODEC-333: Add distinct Base64 decoding for standard and\n      URL-safe formats\n\n  * Fixed Bugs\n\n    + Fix oak leaf icon references in overview.html when running\n      'mvn clean javadoc:javadoc'\n    + Fix Apache RAT plugin console warnings\n    + Fix malformed Javadoc comments\n  * Changes\n    + Bump org.apache.commons:commons-parent from 91 to 96 #415,\n      #418\n    + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n    + Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0\n\n- Update to 1.20.0\n\n  * New features\n\n    + Add org.apache.commons.codec.digest.Crc16\n    + Add builders to org.apache.commons.codec.digest streams and\n      deprecate some old constructors\n    + Add builder to Base16 streams and deprecate some old\n      constructors\n    + Add support for SHAKE128-256 and SHAKE256-512 to 'DigestUtils'\n      and 'MessageDigestAlgorithms' on Java 25 and up\n    + Add BaseNCodec.AbstractBuilder.setDecodeTable(byte[]) and\n      refactor subclasses\n\n  * Changes\n\n    + Deprecate all but one Base32 constructor in favor of the\n      builder added in version 1.17.0\n    + Deprecate all but one Base64 constructor in favor of the\n      builder added in version 1.17.0\n    + BaseNCodecInputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + BaseNCodecOutputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + Bump org.apache.commons:commons-parent from 85 to 91\n    + [test] Bump org.apache.commons:commons-lang3 from 3.18.0 to\n      3.19.0\n\n- Update to 1.19.0\n\n  * New features\n\n    + Add HmacUtils.hmac(Path)\n    + Add HmacUtils.hmacHex(Path)\n    + Add PMD check to the default Maven goal\n    + Add SpotBugs check to the default Maven goal\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Refactor DigestUtils.updateDigest(MessageDigest, File) to use\n      NIO\n    + CODEC-328:  Clarify Javadoc for\n      org.apache.commons.codec.digest.UnixCrypt.crypt(byte[],String)\n    + Precompile regular expressions in DaitchMokotoffSoundex.Rule\n    + Precompile regular expressions in\n      DaitchMokotoffSoundex.parseRules(Scanner, String, Map, Map)\n    + Precompile regular expressions in\n      Lang.loadFromResource(String, Languages)\n    + Precompile regular expressions in\n      PhoneticEngine.encode(String, LanguageSet)\n    + Precompile regular expressions in\n      org.apache.commons.codec.language.bm.Rule.parse*(*)\n    + Remove redundant checks for whitespace in\n      DaitchMokotoffSoundex.soundex(String, boolean)\n    + Javadoc typo in Base16.java #380\n    + Deprecate unused constant org.apache.commons.codec.language.bm\n      .Rule.ALL\n    + CODEC-331: org.apache.commons.codec.language.bm.Rule\n      .parsePhonemeExpr(String) adds duplicate empty phoneme when\n      input ends with |\n    + CODEC-331: org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String) does not remove special\n      characters like punctuation\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.binary.StringUtils\n    + Fix PMD UnusedFormalParameter in private constructor in\n      org.apache.commons.codec.binary.Base16\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Blake3\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Md5Crypt\n    + Fix PMD EmptyControlStatement in\n      org.apache.commons.codec.language.Metaphone\n    + Fix SpotBugs [ERROR] Medium: org.apache.commons.codec.binary\n      .BaseNCodec$AbstractBuilder.setEncodeTable(byte[]) may expose\n      internal representation by storing an externally mutable\n      object into BaseNCodec$AbstractBuilder.encodeTable [org.apache\n      .commons.codec.binary.BaseNCodec$AbstractBuilder] At\n      BaseNCodec.java:[line 131] EI_EXPOSE_REP2\n    + The method org.apache.commons.codec.binary.BaseNCodec\n      .AbstractBuilder.setLineSeparator(byte...) now makes a\n      defensive copy\n    + Avoid unnecessary String conversion in\n      org.apache.commons.codec.language.bm.PhoneticEngine\n      .applyFinalRules(PhonemeBuilder, Map)\n    + Fix SpotBugs [ERROR] High: Potentially dangerous use of\n      non-short-circuit logic in org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String)\n      [org.apache.commons.codec.language.DaitchMokotoffSoundex] At\n      DaitchMokotoffSoundex.java:[line 350]\n      NS_DANGEROUS_NON_SHORT_CIRCUIT\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 79 to 85 #375\n    + [test] Bump commons-io:commons-io from 2.18.0 to 2.20.0\n    + [test] Bump org.apache.commons:commons-lang3 from 3.17.0 to\n      3.18.0 #386\n\n- Update to 1.16.0:\n\n  * Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.\n\n    + Support java.nio.ByteBuffer in\n\n  * Fixed bugs:\n\n- Don't condition the maven defines on release version, but on\n\n  + Add Daitch-Mokotoff Soundex\n  + Make possible to provide padding byte to BaseNCodec in constructor\n    urlSafe parameter\n    is mandatory to call close()\n  + Add support for HMAC Message Authentication Code (MAC) digests\n  + Beider Morse Phonetic Matching producing incorrect tokens\n    using empty strings\n    Issue: CODEC-184.\n  + Fix Javadoc 1.8.0 errors\n  + Fix Java 8 build Javadoc errors\n    Issue: CODEC-189.\n  + Deprecate Charsets Charset constants in favor of Java 7's\n    java.nio.charset.StandardCharsets\n    Issue: CODEC-178.\n  + Update from commons-parent 34 to 35\n    Issue: CODEC-190.\n\n- update to 1.8\n  * Add DigestUtils.updateDigest(MessageDigest, InputStream)\n  * Add Match Rating Approach (MRA) phonetic algorithm encoder\n  * ColognePhonetic encoder unnecessarily creates many char arrays on every loop run\n- add junit4 to fix a build fail\n- update to 1.6, sync with Fedora\n","status":"published","published":"2026-05-29T08:49:10Z","modified":"2026-06-02T18:24:27.401496922Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:02785-1","title":"Security update for apache-commons-lang3","description":"This update for apache-commons-lang3 fixes the following issues:\n\n- CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)\n","status":"published","published":"2025-08-13T11:50:54Z","modified":"2026-02-04T04:16:38.475442Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02786-1","title":"Security update for apache-commons-lang3","description":"This update for apache-commons-lang3 fixes the following issues:\n\n- CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)\n","status":"published","published":"2025-08-13T11:51:16Z","modified":"2026-02-04T02:15:59.064104Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02818-1","title":"Security update for apache-commons-lang3","description":"This update for apache-commons-lang3 fixes the following issues:\n\n- Update to version 3.18.0 \n- CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)\n","status":"published","published":"2025-08-15T12:56:26Z","modified":"2026-03-23T04:49:46.830536Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:21996-1","title":"Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec","description":"This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:\n\nChanges in apache-commons-lang3:\n\nUpdate to 3.20.0\n\n  * New features:\n\n    + Add SystemProperties.getPath(String, Supplier\u003cPath\u003e)\n    + Add JavaVersion.JAVA_25\n    + Add JavaVersion.JAVA_26\n    + Add SystemUtils.IS_JAVA_25\n    + Add SystemUtils.IS_JAVA_26\n    + Add MutablePair.ofNonNull(Map.Entry)\n    + Add TimedSemaphore.builder(), Builder, and deprecate\n      constructors\n    + LANG-1504: Adding labels and history to split StopWatch\n\n  * Fixed Bugs:\n\n    + Optimize ObjectToStringComparator.compare() method\n    + [javadoc] Improve StringUtils Javadoc\n    + Fix internal inverted logic in private isEnum() method and\n      correct its usage in getFirstEnum()\n    + Use accessors in ToStringStyle so subclasses can effectively\n      override them\n    + 'LocaleUtils.toLocale(String)' for a 2 letter country code\n      now returns a value instead of throwing an\n      'IllegalArgumentException'\n    + Fix typo in StringUtils.trunctate() IllegalArgumentException\n      message and test assertion messages\n    + Fix test fixture in\n      ReflectionDiffBuilderTest.testTransientFieldDifference()\n    + LANG-1789: NullPointerException when generating\n      NoSuchMethodException in MethodUtils\n    + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE\n      WARNINGs to the console\n    + LANG-1792: TypeUtils.toString() skips angle brackets for Class\n      type\n    + Mention JDK 25 LTS as a tested version in the release notes\n  * Changes:\n    + Bump org.apache.commons:commons-parent from 88 to 92\n\n- Update to 3.19.0\n\n  * New features:\n\n    + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH\n    + Add SystemUtils.IS_OS_NETWARE\n    + Add MethodUtils.getAccessibleMethod(Class, Method)\n    + Add documentation to site for CVE-2025-48924\n      ClassUtils.getClass(...) can throw a StackOverflowError on\n      very long inputs\n    + Add StringUtils.indexOfAny(CharSequence, int, char...)\n    + Add ConcurrentException.ConcurrentException(String)\n    + Add DateUtils.toLocalDateTime(Date[, TimeZone])\n    + Add DateUtils.toOffsetDateTime(Date[, TimeZone])\n    + Add DateUtils.toZonedDateTime(Date[, TimeZone])\n    + Add ByteConsumer\n    + Add ByteSupplier\n    + Add FailableByteConsumer\n    + Add FailableByteSupplier\n    + LANG-1784: Add Functions methods for null-safe mapping and\n      chaining\n    + LANG-1784: Add Failable methods for null-safe mapping and\n      chaining\n    + Add DoubleRange.fit(double)\n    + Add IntegerRange.fit(int)\n    + Add LongRange.fit(long)\n    + Add DurationUtils.get(String, TemporalUnit, long)\n    + Add DurationUtils.getMillis(String, long)\n    + Add DurationUtils.getSeconds(String, long)\n    + Add SystemProperties.getBoolean(Class, String, boolean)\n    + Add SystemProperties.getInt(Class, String, int)\n    + Add SystemProperties.getLong(Class, String, long)\n\n  * Fixed Bugs:\n\n    + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the\n      hierarchy of methods\n    + MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...) now\n      returns null instead of throwing a NullPointerException, as it\n      does for other exception types\n    + Reduce spurious failures in ArrayUtilsTest methods that test\n      ArrayUtils.shuffle() methods\n    + MethodUtils cannot find or invoke a public method on a public\n      class implemented in its package-private superclass\n    + AtomicSafeInitializer.get() can spin internally if the\n      FailableSupplier given to AbstractConcurrentInitializer\n      .AbstractBuilder.setInitializer(FailableSupplier) throws a\n      RuntimeException\n    + LANG-1783: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + LANG-1782: MethodUtils cannot find or invoke vararg methods\n      without providing vararg types or values\n    + MethodUtils cannot find or invoke vararg methods of interface\n      types\n    + MethodUtils cannot find or invoke vararg methods when widening\n      primitive types following the JLS 5.1.2. Widening Primitive\n      Conversion\n    + LANG-1597: Invocation fails because matching varargs method\n      found but then discarded\n    + Don't check accessibility twice in MemberUtils\n      .setAccessibleWorkaround(T)\n    + LANG-1774: Improve handling of ClassUtils\n      .getShortCanonicalName() for invalid input\n    + LANG-1720: Improve Javadocs for Conversion\n    + Fix CalendarUtils.toLocalDate() Javadoc return type\n      description\n    + Fix the method name in Javadoc examples for CharUtils.isHex()\n    + Deprecate NumberUtils.compare(byte, byte) in favor of\n      Byte.compare(byte, byte)\n    + Deprecate NumberUtils.compare(int, int) in favor of\n      Integer.compare(int, int)\n    + Deprecate NumberUtils.compare(long, long) in favor of\n      Long.compare(long, long)\n    + Deprecate NumberUtils.compare(short, short) in favor of\n      Short.compare(short, short)\n    + Deprecate obsolete system property constant\n      SystemProperties.AWT_TOOLKIT\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_FONTS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_GRAPHICSENV\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_HEADLESS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_PRINTERJOB\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_COMPILER\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_ENDORSED_DIRS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_EXT_DIRS\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getAwtToolkit()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtFonts()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtGraphicsenv()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtHeadless()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtPrinterjob()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaCompiler()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaEndorsedDirs()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaExtDirs()\n    + Deprecate method for obsolete system property constant\n      SystemUtils.isJavaAwtHeadless()\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_FONTS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_GRAPHICSENV\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_HEADLESS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_PRINTERJOB\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_COMPILER\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_ENDORSED_DIRS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_EXT_DIRS\n    + [javadoc] General improvements\n    + [javadoc] Fix thrown exception documentation for\n      MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...)\n    + [javadoc] Strings::equalsAny: CI doc string should show it's\n      insensitive\n    + [javadoc] General Javadoc improvements\n    + LANG-1780: [javadoc] Fix Strings Javadoc\n    + [javadoc] Fix typo in Javadoc of Strings instances\n    + [javadoc] Fix Javadocs in ClassUtils\n    + [javadoc] Fix @deprecated link for StringUtils#startsWithAny\n    + Replace old feather logotype with new oak logotype\n  * Changes:\n    + [test] Bump org.apache.commons:commons-text from 1.13.1 to\n      1.14.0\n    + Bump org.apache.commons:commons-parent from 85 to 88\n\n- Update to 3.18.0\n\n- Fix component version in default.properties to 3.12\n\n    * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.\n    * Add FailableShortSupplier, handy for JDBC APIs.\n    * Add JavaVersion.JAVA_17.\n    * Add StringUtils.substringBefore(String, int).\n    * Add Range.INTEGER.\n    * Add DurationUtils.\n    * Correct implementation of RandomUtils.nextLong(long, long).\n    * Update maven-surefire-plugin 2.22.2 -\u003e 3.0.0-M5.\n    * Bump junit-bom from 5.7.0 to 5.7.1.\n    * Ignored exception 'ignored', should not be called so.\n    * Change array style from 'int a[]' to 'int[] a'.\n\nChanges in apache-commons-text:\n\n- Upgrade to version 1.15.0\n\n  * New features\n\n    + Add experimental CycloneDX VEX file\n    + TEXT-235: Add Damerau-Levenshtein distance\n    + Add unit tests to increase coverage\n    + Add new test for CharSequenceTranslator#with()\n    + Add tests and assertions to org.apache.commons.text.similarity\n      to get to 100% code coverage\n\n  * Fixed Bugs\n\n    + Fix exception message typo in XmlStringLookup\n      .XmlStringLookup(Map, Path...)\n    + TEXT-236: Inserting at the end of a TextStringBuilder throws\n      a StringIndexOutOfBoundsException\n    + Fix TextStringBuilderTest.testAppendToCharBuffer() to use\n      proper argument type\n    + Fix Apache RAT plugin console warnings\n    + Fix site XML to use version 2.0.0 XML schema\n    + Removed unreachable threshold verification code in\n      src/main/java/org/apache/commons/text/similarity\n    + Enable secure processing for the XML parser in XmlStringLookup\n      in case the underlying JAXP implementation doesn't\n\n- Upgrade to version 1.14.0\n\n  * New features\n\n    + Interface StringLookup now extends UnaryOperator\u003cString\u003e\n    + Interface TextRandomProvider extends IntUnaryOperator\n    + Add RandomStringGenerator.Builder\n      .usingRandom(IntUnaryOperator)\n    + Add PMD check to default Maven goal\n    + Add org.apache.commons.text.RandomStringGenerator.Builder\n      .setAccumulate(boolean)\n\n  * Fixed Bugs\n\n    + Fix PMD UnnecessaryFullyQualifiedName in StringLookupFactory\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      DefaultStringLookupsHolder\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      PropertiesStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      JavaPlatformStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in StringSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in StrSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in AlphabetConverter\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in\n      TextStringBuilder\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in StrBuilder\n    + org.apache.commons.text.translate.LookupTranslator\n      .LookupTranslator(Map CharSequence\u003e) now throws\n      NullPointerException instead of\n      java.security.InvalidParameterException\n\n- Upgrade to version 1.13.1\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Deprecate EntityArrays.EntityArrays()\n    + StringLookupFactory.DefaultStringLookupsHolder\n      .createDefaultStringLookups() maps DefaultStringLookup\n      .LOCAL_HOST twice instead of once for LOCAL_HOST and\n      LOOPBACK_ADDRESS\n\n- Upgrade to version 1.13.0\n\n  * New features\n\n    + Add StringLookupFactory.loopbackAddressStringLookup()\n    + Add StringLookupFactory.KEY_LOOPBACK_ADDRESS\n    + Add DefaultStringLookup.LOOPBACK_ADDRESS\n    + Add richer inputs in package org.apache.commons.text\n      .similarity with SimilarityInput\n    + Add HammingDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardSimilarity.apply(SimilarityInput, SimilarityInput)\n    + Add JaroWinklerDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add JaroWinklerSimilarity.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDetailedDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDistance.apply(SimilarityInput,\n      SimilarityInput)\n\n  * Fixed Bugs\n\n    + Fix build on Java 22\n    + Fix build on Java 23-ea\n    + Make package-private constructor private:\n      StrLookup.MapStrLookup.MapStrLookup(Map)\n    + Make package-private constructor private: StrLookup\n      .SystemPropertiesStrLookup.SystemPropertiesStrLookup()\n    + Make package-private class private and final: MapStrLookup\n    + Make package-private class private: StrMatcher.CharMatcher\n    + Make package-private class private: StrMatcher.CharSetMatcher\n    + Make package-private class private: StrMatcher.NoMatcher\n    + Make package-private class private: StrMatcher.StringMatcher\n    + Make package-private class private: StrMatcher.TrimMatcher\n    + Make package-private class private and final:\n      IntersectionSimilarity.BagCount\n    + Make package-private class private and final:\n      IntersectionSimilarity.TinyCount\n    + Deprecate LevenshteinDistance.LevenshteinDistance() in favor\n      of LevenshteinDistance.getDefaultInstance()\n    + Deprecate LevenshteinDetailedDistance\n      .LevenshteinDetailedDistance() in favor of\n      LevenshteinDetailedDistance.getDefaultInstance()\n    + TEXT-234: Improve StrBuilder documentation for new line text\n    + TEXT-234: Improve TextStringBuilder documentation for new line\n      text\n    + TEXT-233: Required OSGi Import-Package version numbers in\n      MANIFEST.MF\n\n- Upgrade to version 1.12.0\n\n  * New features\n\n    + Add StringLookupFactory.fileStringLookup(Path...) and\n      deprecated fileStringLookup()\n    + Add StringLookupFactory.propertiesStringLookup(Path...) and\n      deprecated propertiesStringLookup()\n    + Add StringLookupFactory.xmlStringLookup(Map, Path...) and\n      deprecated xmlStringLookup() and xmlStringLookup(Map)\n    + Add StringLookupFactory.builder() for fencing Path resolution\n      of the file, properties and XML lookups\n    + Add DoubleFormat.Builder.get() as Builder now implements\n      Supplier\n\n  * Fixed Bugs\n\n    + TEXT-232: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + TEXT-175: Fix regression for determining whitespace in\n      WordUtils\n    + Deprecate Builder in favor of Supplier\n\n- Upgrade to version 1.11.0\n\n  * New features\n\n    + TEXT-224: Set SecureProcessing feature in XmlStringLookup by\n      default\n    + TEXT-224: Add StringLookupFactory.xmlStringLookup(Map\u003cString,\n      Boolean\u003e...)\n    + Add @FunctionalInterface to FormatFactory\n    + Add RandomStringGenerator.builder()\n    + TEXT-229: Add XmlEncoderStringLookup/XmlDecoderStringLookup\n    + Add StringSubstitutor.toString()\n\n  * Fixed Bugs\n\n    + TEXT-219: Fix StringTokenizer.getTokenList to return an\n      independent modifiable list\n    + Fix Javadoc for StringEscapeUtils.escapeHtml4\n    + TextStringBuidler#hashCode() allocates a String on each call\n    + TEXT-221: Fix Bundle-SymbolicName to use the package name\n      org.apache.commons.text\n    + Add and use a package-private singleton for RegexTokenizer\n    + Add and use a package-private singleton for CosineSimilarity\n    + Add and use a package-private singleton for\n      LongestCommonSubsequence\n    + Add and use a package-private singleton for\n      JaroWinklerSimilarity\n    + Add and use a package-private singleton for JaccardSimilarity\n    + [StepSecurity] ci: Harden GitHub Actions\n    + Improve AlphabetConverter Javadoc\n    + Fix exception message in IntersectionResult to make\n      set-theoretic sense\n    + Add null-check in RandomStringGenerator#Builder#selectFrom()\n      to avoid NullPointerException\n    + Add null-check in RandomStringGenerator#Builder#withinRange()\n      to avoid NullPointerException\n    + TEXT-228: Fix TextStringBuilder to over-allocate when ensuring\n      capacity\n    + Constructor for ResourceBundleStringLookup should be private\n      instead of package-private\n    + Constructor for UrlDecoderStringLookup should be private\n      instead of package-private\n    + Constructor for UrlEncoderStringLookup should be private\n      instead of package-private\n    + TEXT-230: Javadoc of org.apache.commons.text.lookup\n      .DefaultStringLookup.XML is incorrect\n    + Update DoubleFormat to state it is based on Double.toString\n\n    + Removed non-existing parameter from Javadocs and spelled out\n    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin\n    + Refactor TextStringBuilder.readFrom(Readable), extracting\n    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,\n    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],\n\nChanges in apache-commons-configuration2:\n\n- Upgrade to version 2.15.0\n\n  * Changes\n\n    + Disable include schemes http[s] by default, see\n      AbstractFileLocationStrategy\n    + Detect and avoid processing cycles in YAML input\n      (YAMLConfiguration) (bsc#1265299, CVE-2026-45205)\n    + Extend scheme validation to inner schemes of jar: URLs\n\n- Upgrade to version 2.14.0\n\n  * New features\n\n    + Add XMLConfiguration.read(Element)\n    + Add ConfigurationException.ConfigurationException(String,\n      Object...)\n    + Add ConfigurationException.ConfigurationException(Throwable,\n      String, Object...)\n    + Add ConversionException.ConversionException(String, Object...)\n    + Add ConversionException.ConversionException(Throwable, String,\n      Object...)\n    + Add ConfigurationRuntimeException\n      .ConfigurationRuntimeException(Throwable, String, Object...)\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + Migrate from deprecated APIs\n\n- Upgrade to version 2.13.0\n\n  * New features\n\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .entrySet()\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .forEach(BiConsumer\u003cString, Object\u003e)\n    + Add VEX entry for CVE-2025-48924\n\n  * Fixed Bugs\n\n    + Shared primitive variable \"throwExceptionOnMissing\" in one\n      thread may not yield the value of the most recent write from\n      another thread [org.apache.commons.configuration2\n      .AbstractConfiguration] At AbstractConfiguration.java:\n      [line 1493] AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + Shared primitive variable \"forceSingleLine\" in one thread may\n      not yield the value of the most recent write from another\n      thread [org.apache.commons.configuration2\n      .PropertiesConfigurationLayout]\n      At PropertiesConfigurationLayout.java:[line 821]\n      AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + CONFIGURATION-849: Fix undoubling of strings\n    + CONFIGURATION-852: Mark the package jakarta.servlet.* import\n      as optional in OSGi\n    + Fix build [WARNING] Parameter 'forkMode' is unknown for plugin\n      'maven-surefire-plugin:3.5.3:test (default-test)'\n\n- Upgrade to version 2.12.0\n\n  * New features:\n\n    + Add PrefixedKeysIterator.toString() to package-private\n      PrefixedKeysIterator\n    + CONFIGURATION-836: New web configurations using the\n      jakarta.servlet namespace are now available\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletContextConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletFilterConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletRequestConfiguration\n    + Add org.apache.commons.configuration2\n      .AbstractHierarchicalConfiguration.getKeysInternal(String,\n      String)\n\n  * Fixed Bugs:\n\n    + PropertyConverter.to(Class, Object, DefaultConversionHandler)\n      doesn't convert custom java.lang.Number subclasses\n    + DefaultConversionHandler.convertValue(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + DefaultConversionHandler.to(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + CONFIGURATION-848: SubsetConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + CONFIGURATION-848: CompositeConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + Describe the security model\n    + De-emphasize the 1.x version line on the website\n    + CONFIGURATION-851: HomeDirectoryLocationStrategy no longer\n      resolves the user HOME directory correctly\n\n- Upgrade to version 2.11.0\n\n  * New features\n\n    + CONFIGURATION-844: Add support for empty sections\n    + Add ImmutableConfiguration.containsValue(Object)\n\n  * Fixed Bugs\n\n    + Fail-fast with a NullPointerException if DataConfiguration\n      .DataConfiguration(Configuration) is called with null\n    + Fail-fast with a NullPointerException if\n      XMLPropertiesConfiguration.XMLPropertiesConfiguration(Element)\n      is called with null\n    + Fail-fast with a NullPointerException if a SubsetConfiguration\n      constructor is called with a null Configuration\n    + CONFIGURATION-843: Methods should not be empty\n    + Guard MapConfiguration against null maps\n    + Fail-fast with a NullPointerException if\n      AppletConfiguration(Applet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(ServletConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(ServletContext) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletFilterConfiguration(FilterConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletRequestConfiguration(ServletRequest) is called with\n      null\n    + Deprecate DatabaseConfiguration.getDatasource() in favor of\n      getDataSource()\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractImmutableNodeHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractListDelimiterHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      DefaultPrefixLookupsHolder\n    + Fix PMD DynamicCombinedConfiguration in\n      DynamicCombinedConfiguration\n    + Fix PMD DynamicCombinedConfiguration in\n      PropertiesConfiguration\n    + CONFIGURATION-846: Restore previous behavior allowing Spring\n      to inject multiple values\n    + CONFIGURATION-847: Property with an empty string value was not\n      processed\n\nChanges in apache-commons-cli:\n\n- Update to 1.11.0\n\n  * New Features\n\n    + Add CommandLine.getOptionCount() to measure option repetition\n\n  * Fixed Bugs\n\n    + CLI-351: Multiple trailing BREAK_CHAR_SET characters cause\n      infinite loop in HelpFormatter\n    + CLI-351:  Fix issue with groups not being reported in help\n      output\n\nChanges in apache-commons-io:\n\n- Upgrade to 2.22.0\n\n  * New features\n\n    + Add and use IOUtils.closeQuietlySuppress(Closeable, Throwable)\n    + Add ProxyWriter.setReference(Writer)\n    + Add ProxyWriter.unwrap()\n    + Add ProxyReader.setReference(Reader)\n    +Add ProxyReader.unrwap()\n    + IO-883: ByteArraySeekableByteChannel should optionally\n      configure a read-only channel\n    + IO-883: Add ByteArraySeekableByteChannel.Builder and builder()\n    + IO-883: Add AbstractStreamBuilder.getByteArray()\n    + CloseShieldInputStream now supports a custom close shield as\n      a function\n    + Add FlushShieldOutputStream to workaround issues in generic\n      code that ends up calling third parties like like\n      org.tukaani.xz.LZMAOutputStream.flush()\n    + Add filter channels\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + ByteArraySeekableByteChannel.position(long) and truncate(long)\n      shouldn't throw an IllegalArgumentException for a new positive\n      position that's too large\n    + Fix malformed Javadoc comments\n    + ReadAheadInputStream.close() doesn't always close its filtered\n      input stream\n    + ReadAheadInputStream now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + FileAlterationMonitor.stop(long) now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + FileCleaningTracker now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThreadMonitor.run() now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() doesn't preserve the original\n      InterruptedException as the cause of its\n      InterruptedIOException\n    + All thread names are now prefixed with \"commons-io-\"\n    + IO-639: ReversedLinesFileReader does not read first line if\n      its empty\n    + IO-886: Fixed incorrect regular expression in\n      PathUtils.RelativeSortedPaths.extractKey(String, String)\n    + Fix typos in Javadoc of FileUtils and related test classes\n    + IO-887: WriterOutputStream from a builder fails on malformed\n      or unmappable input bytes\n    + BoundedReader now extends ProxyReader\n    + AbstractStreamBuilder.setOpenOptions(OpenOption...) now makes\n      a defensive copy of its input array\n    + IO-885: Path visits follow links\n    + BOMInputStream fail-fast and tracks its ByteOrderMark as a final\n    + Refactor UnixLineEndingInputStream and\n      WindowsLineEndingInputStream for duplication\n    + IO-857: [Javadoc] PathUtils.cleanDirectory() methods vs FileUtils\n    + Fix JaCoCo report generation (code coverage)\n    + AbstractStreamBuilder.setBufferSizeDefault(int) now resets to\n      default for input less than or equal to zero\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 91 to 98\n    + Bump commons-codec:commons-codec from 1.19.0 to 1.21.0\n    + Bump commons.bytebuddy.version from 1.17.8 to 1.18.8\n    + Bump commons-lang3 from 3.19.0 to 3.20.0\n\nChanges in apache-commons-codec:\n\n- Update to 1.22.0\n\n  * New features\n\n    + CODEC-326: Add Base58 support\n    + Add BaseNCodecInputStream.AbstracBuilder.setByteArray(byte[])\n    + CODEC-335: Add GitIdentifiers to compute Git blob and tree\n      object identifiers\n\n  * Fixed Bugs\n\n    + CODEC-249: Fix Incorrect transform of CH digraph according\n      Metaphone basic rules #423\n    + CODEC-317: ColognePhonetic can create duplicate consecutive\n      codes in some cases\n    + Add boundary tests for BinaryCodec.fromAscii partial-bit\n      inputs #425\n    + CODEC-336: Base64.Builder.setUrlSafe(boolean) Javadoc\n      incorrectly states null is accepted for primitive boolean\n      parameter\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 96 to 98\n\n- Update to 1.21.0\n\n  * New features\n\n    + CODEC-333: Add distinct Base64 decoding for standard and\n      URL-safe formats\n\n  * Fixed Bugs\n\n    + Fix oak leaf icon references in overview.html when running\n      'mvn clean javadoc:javadoc'\n    + Fix Apache RAT plugin console warnings\n    + Fix malformed Javadoc comments\n  * Changes\n    + Bump org.apache.commons:commons-parent from 91 to 96 #415,\n      #418\n    + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n    + Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0\n\n- Update to 1.20.0\n\n  * New features\n\n    + Add org.apache.commons.codec.digest.Crc16\n    + Add builders to org.apache.commons.codec.digest streams and\n      deprecate some old constructors\n    + Add builder to Base16 streams and deprecate some old\n      constructors\n    + Add support for SHAKE128-256 and SHAKE256-512 to 'DigestUtils'\n      and 'MessageDigestAlgorithms' on Java 25 and up\n    + Add BaseNCodec.AbstractBuilder.setDecodeTable(byte[]) and\n      refactor subclasses\n\n  * Changes\n\n    + Deprecate all but one Base32 constructor in favor of the\n      builder added in version 1.17.0\n    + Deprecate all but one Base64 constructor in favor of the\n      builder added in version 1.17.0\n    + BaseNCodecInputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + BaseNCodecOutputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + Bump org.apache.commons:commons-parent from 85 to 91\n    + [test] Bump org.apache.commons:commons-lang3 from 3.18.0 to\n      3.19.0\n\n- Update to 1.19.0\n\n  * New features\n\n    + Add HmacUtils.hmac(Path)\n    + Add HmacUtils.hmacHex(Path)\n    + Add PMD check to the default Maven goal\n    + Add SpotBugs check to the default Maven goal\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Refactor DigestUtils.updateDigest(MessageDigest, File) to use\n      NIO\n    + CODEC-328:  Clarify Javadoc for\n      org.apache.commons.codec.digest.UnixCrypt.crypt(byte[],String)\n    + Precompile regular expressions in DaitchMokotoffSoundex.Rule\n    + Precompile regular expressions in\n      DaitchMokotoffSoundex.parseRules(Scanner, String, Map, Map)\n    + Precompile regular expressions in\n      Lang.loadFromResource(String, Languages)\n    + Precompile regular expressions in\n      PhoneticEngine.encode(String, LanguageSet)\n    + Precompile regular expressions in\n      org.apache.commons.codec.language.bm.Rule.parse*(*)\n    + Remove redundant checks for whitespace in\n      DaitchMokotoffSoundex.soundex(String, boolean)\n    + Javadoc typo in Base16.java #380\n    + Deprecate unused constant org.apache.commons.codec.language.bm\n      .Rule.ALL\n    + CODEC-331: org.apache.commons.codec.language.bm.Rule\n      .parsePhonemeExpr(String) adds duplicate empty phoneme when\n      input ends with |\n    + CODEC-331: org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String) does not remove special\n      characters like punctuation\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.binary.StringUtils\n    + Fix PMD UnusedFormalParameter in private constructor in\n      org.apache.commons.codec.binary.Base16\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Blake3\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Md5Crypt\n    + Fix PMD EmptyControlStatement in\n      org.apache.commons.codec.language.Metaphone\n    + Fix SpotBugs [ERROR] Medium: org.apache.commons.codec.binary\n      .BaseNCodec$AbstractBuilder.setEncodeTable(byte[]) may expose\n      internal representation by storing an externally mutable\n      object into BaseNCodec$AbstractBuilder.encodeTable [org.apache\n      .commons.codec.binary.BaseNCodec$AbstractBuilder] At\n      BaseNCodec.java:[line 131] EI_EXPOSE_REP2\n    + The method org.apache.commons.codec.binary.BaseNCodec\n      .AbstractBuilder.setLineSeparator(byte...) now makes a\n      defensive copy\n    + Avoid unnecessary String conversion in\n      org.apache.commons.codec.language.bm.PhoneticEngine\n      .applyFinalRules(PhonemeBuilder, Map)\n    + Fix SpotBugs [ERROR] High: Potentially dangerous use of\n      non-short-circuit logic in org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String)\n      [org.apache.commons.codec.language.DaitchMokotoffSoundex] At\n      DaitchMokotoffSoundex.java:[line 350]\n      NS_DANGEROUS_NON_SHORT_CIRCUIT\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 79 to 85 #375\n    + [test] Bump commons-io:commons-io from 2.18.0 to 2.20.0\n    + [test] Bump org.apache.commons:commons-lang3 from 3.17.0 to\n      3.18.0 #386\n\n- Update to 1.16.0:\n\n  * Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.\n\n    + Support java.nio.ByteBuffer in\n\n  * Fixed bugs:\n\n- Don't condition the maven defines on release version, but on\n\n  + Add Daitch-Mokotoff Soundex\n  + Make possible to provide padding byte to BaseNCodec in constructor\n    urlSafe parameter\n    is mandatory to call close()\n  + Add support for HMAC Message Authentication Code (MAC) digests\n  + Beider Morse Phonetic Matching producing incorrect tokens\n    using empty strings\n    Issue: CODEC-184.\n  + Fix Javadoc 1.8.0 errors\n  + Fix Java 8 build Javadoc errors\n    Issue: CODEC-189.\n  + Deprecate Charsets Charset constants in favor of Java 7's\n    java.nio.charset.StandardCharsets\n    Issue: CODEC-178.\n  + Update from commons-parent 34 to 35\n    Issue: CODEC-190.\n\n- update to 1.8\n  * Add DigestUtils.updateDigest(MessageDigest, InputStream)\n  * Add Match Rating Approach (MRA) phonetic algorithm encoder\n  * ColognePhonetic encoder unnecessarily creates many char arrays on every loop run\n- add junit4 to fix a build fail\n- update to 1.6, sync with Fedora\n","status":"published","published":"2026-05-29T08:47:36Z","modified":"2026-06-09T18:24:26.494718322Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:3390-1","title":"Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn","description":"This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues:\n\napache-commons-lang3 was updated to 3.20.0:\n\n  * New features:\n\n    + Add SystemProperties.getPath(String, Supplier\u003cPath\u003e)\n    + Add JavaVersion.JAVA_25\n    + Add JavaVersion.JAVA_26\n    + Add SystemUtils.IS_JAVA_25\n    + Add SystemUtils.IS_JAVA_26\n    + Add MutablePair.ofNonNull(Map.Entry)\n    + Add TimedSemaphore.builder(), Builder, and deprecate\n      constructors\n    + LANG-1504: Adding labels and history to split StopWatch\n\n  * Fixed Bugs:\n\n    + Optimize ObjectToStringComparator.compare() method\n    + [javadoc] Improve StringUtils Javadoc\n    + Fix internal inverted logic in private isEnum() method and\n      correct its usage in getFirstEnum()\n    + Use accessors in ToStringStyle so subclasses can effectively\n      override them\n    + 'LocaleUtils.toLocale(String)' for a 2 letter country code\n      now returns a value instead of throwing an\n      'IllegalArgumentException'\n    + Fix typo in StringUtils.trunctate() IllegalArgumentException\n      message and test assertion messages\n    + Fix test fixture in\n      ReflectionDiffBuilderTest.testTransientFieldDifference()\n    + LANG-1789: NullPointerException when generating\n      NoSuchMethodException in MethodUtils\n    + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE\n      WARNINGs to the console\n    + LANG-1792: TypeUtils.toString() skips angle brackets for Class\n      type\n    + Mention JDK 25 LTS as a tested version in the release notes\n\n  * Changes:\n\n    + Bump org.apache.commons:commons-parent from 88 to 92\n\nUpdate to 3.19.0:\n\n  * New features:\n    + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH\n    + Add SystemUtils.IS_OS_NETWARE\n    + Add MethodUtils.getAccessibleMethod(Class, Method)\n    + Add documentation to site for CVE-2025-48924\n      ClassUtils.getClass(...) can throw a StackOverflowError on\n      very long inputs\n    + Add StringUtils.indexOfAny(CharSequence, int, char...)\n    + Add ConcurrentException.ConcurrentException(String)\n    + Add DateUtils.toLocalDateTime(Date[, TimeZone])\n    + Add DateUtils.toOffsetDateTime(Date[, TimeZone])\n    + Add DateUtils.toZonedDateTime(Date[, TimeZone])\n    + Add ByteConsumer\n    + Add ByteSupplier\n    + Add FailableByteConsumer\n    + Add FailableByteSupplier\n    + LANG-1784: Add Functions methods for null-safe mapping and\n      chaining\n    + LANG-1784: Add Failable methods for null-safe mapping and\n      chaining\n    + Add DoubleRange.fit(double)\n    + Add IntegerRange.fit(int)\n    + Add LongRange.fit(long)\n    + Add DurationUtils.get(String, TemporalUnit, long)\n    + Add DurationUtils.getMillis(String, long)\n    + Add DurationUtils.getSeconds(String, long)\n    + Add SystemProperties.getBoolean(Class, String, boolean)\n    + Add SystemProperties.getInt(Class, String, int)\n    + Add SystemProperties.getLong(Class, String, long)\n  * Fixed Bugs:\n    + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the\n      hierarchy of methods\n    + MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...) now\n      returns null instead of throwing a NullPointerException, as it\n      does for other exception types\n    + Reduce spurious failures in ArrayUtilsTest methods that test\n      ArrayUtils.shuffle() methods\n    + MethodUtils cannot find or invoke a public method on a public\n      class implemented in its package-private superclass\n    + AtomicSafeInitializer.get() can spin internally if the\n      FailableSupplier given to AbstractConcurrentInitializer\n      .AbstractBuilder.setInitializer(FailableSupplier) throws a\n      RuntimeException\n    + LANG-1783: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + LANG-1782: MethodUtils cannot find or invoke vararg methods\n      without providing vararg types or values\n    + MethodUtils cannot find or invoke vararg methods of interface\n      types\n    + MethodUtils cannot find or invoke vararg methods when widening\n      primitive types following the JLS 5.1.2. Widening Primitive\n      Conversion\n    + LANG-1597: Invocation fails because matching varargs method\n      found but then discarded\n    + Don't check accessibility twice in MemberUtils\n      .setAccessibleWorkaround(T)\n    + LANG-1774: Improve handling of ClassUtils\n      .getShortCanonicalName() for invalid input\n    + LANG-1720: Improve Javadocs for Conversion\n    + Fix CalendarUtils.toLocalDate() Javadoc return type\n      description\n    + Fix the method name in Javadoc examples for CharUtils.isHex()\n    + Deprecate NumberUtils.compare(byte, byte) in favor of\n      Byte.compare(byte, byte)\n    + Deprecate NumberUtils.compare(int, int) in favor of\n      Integer.compare(int, int)\n    + Deprecate NumberUtils.compare(long, long) in favor of\n      Long.compare(long, long)\n    + Deprecate NumberUtils.compare(short, short) in favor of\n      Short.compare(short, short)\n    + Deprecate obsolete system property constant\n      SystemProperties.AWT_TOOLKIT\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_FONTS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_GRAPHICSENV\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_HEADLESS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_PRINTERJOB\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_COMPILER\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_ENDORSED_DIRS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_EXT_DIRS\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getAwtToolkit()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtFonts()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtGraphicsenv()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtHeadless()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtPrinterjob()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaCompiler()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaEndorsedDirs()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaExtDirs()\n    + Deprecate method for obsolete system property constant\n      SystemUtils.isJavaAwtHeadless()\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_FONTS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_GRAPHICSENV\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_HEADLESS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_PRINTERJOB\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_COMPILER\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_ENDORSED_DIRS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_EXT_DIRS\n    + [javadoc] General improvements\n    + [javadoc] Fix thrown exception documentation for\n      MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...)\n    + [javadoc] Strings::equalsAny: CI doc string should show it's\n      insensitive\n    + [javadoc] General Javadoc improvements\n    + LANG-1780: [javadoc] Fix Strings Javadoc\n    + [javadoc] Fix typo in Javadoc of Strings instances\n    + [javadoc] Fix Javadocs in ClassUtils\n    + [javadoc] Fix @deprecated link for StringUtils#startsWithAny\n    + Replace old feather logotype with new oak logotype\n  * Changes:\n    + [test] Bump org.apache.commons:commons-text from 1.13.1 to\n      1.14.0\n    + Bump org.apache.commons:commons-parent from 85 to 88\n\nUpdate to 3.18.0:\n\n- Fix component version in default.properties to 3.12\n\n    * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.\n    * Add FailableShortSupplier, handy for JDBC APIs.\n    * Add JavaVersion.JAVA_17.\n    * Add StringUtils.substringBefore(String, int).\n    * Add Range.INTEGER.\n    * Add DurationUtils.\n    * Correct implementation of RandomUtils.nextLong(long, long).\n    * Update maven-surefire-plugin 2.22.2 -\u003e 3.0.0-M5.\n    * Bump junit-bom from 5.7.0 to 5.7.1.\n    * Ignored exception 'ignored', should not be called so.\n    * Change array style from 'int a[]' to 'int[] a'.\n\ngoogle-guice was updated to fix:\n\n- Fix build with Java 25\n- Add alias to com.google.inject:guice::classes artifact, needed\n  by maven 4.x\n\n\nmaven-resolver-supplier was updated to upstream version 1.9.27:\n\n  * Bug Fixes\n    + Sync TrackingFileManager with 2.x\n\nUpdate to upstream version 1.9.26:\n\n  * New features and improvements\n    + GH-1773: Treat 410 Gone as 404 Not Found\n    + GH-1737: Revert partially parallel upload change\n  * Bug Fixes\n    + GH-1768; Drastically simplify auth caching\n    + [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF\n  * Documentation updates\n    + Clarify that HTTP Transport uses Apache HTTP Client\n  * Dependency updates\n    + Bump org.redisson:redisson from 3.52.0 to 4.2.0\n    + Bump commons-codec:commons-codec from 1.20.0 to 1.21.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26\n      to 1.27\n    + Bump org.apache.maven:maven-parent from 46 to 47\n    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from\n      0.25.0 to 0.25.4\n    + Bump mavenVersion from 3.9.11 to 3.9.12\n\n- Update to upstream version 1.9.25\n  * New features and improvements\n    + Add scope support for trusted checksums\n    + Name mappers cleanup and new GAECV mapper\n    + Proper metadata locking support\n    + Ability to augment metadata nature for version range request\n  * Bug Fixes\n    + TrackingFileManager changes\n    + Maven filters daemon friendly\n    + Remove hack from Basic connector\n    + Fix locking issues\n  * Documentation updates\n    + Updated the documentation to reflect the current list of name\n      mappers\n  * Maintenance\n    + Mild backport: support same properties as Resolver 2.x\n    + Maven resolver lockrepro\n    + Bugfix: Java 25 broke test\n  * Dependency updates\n    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from\n      0.23.1 to 0.25.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24\n      to 1.26\n    + Bump commons-codec:commons-codec from 1.18.0 to 1.20.0\n    + Bump org.redisson:redisson from 3.50.0 to 3.52.0\n    + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre\n    + Bump com.google.code.gson:gson from 2.13.1 to 2.13.2\n    + Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814\n    + Bump mavenVersion from 3.9.10 to 3.9.11\n\n- Update to upstream version 1.9.24\n  * New features and improvements\n    + Metadata type out of coordinates\n    + RFC9457 implementation\n    + Intern context strings\n  * Maintenance\n    + Align plexus-util version with Maven\n    + Align guice version with Maven\n    + Enable Github Issues (1.9.x branch)\n- Build also maven-resolver-supplier package in separate spec file\n\n- Add dependency on objectweb-asm to build with sisu 0.9.0.M4\n\n- Update to upstream version 1.9.23\n  * Bug\n    + MRESOLVER-659: NPE in trusted checksum post processor if\n  * Improvement\n    + MRESOLVER-680: Disable checksum by default for .sigstore.json\n      as well\n    + MRESOLVER-703: HTTP transport should expose config for max\n      redirects\n\n- Upgrade to upstream version 1.9.22\n  * Bug\n    + MRESOLVER-572: Resolver-Supplier unusable in OSGi runtimes\n    + MRESOLVER-574: Invalid Cookie set under proxy conditions\n    + MRESOLVER-586: In typical setups, DefaultArtifact copies the\n      same maps over and over again\n    + MRESOLVER-587: Memory consumption improvements\n  * New Feature\n    + MRESOLVER-571: Import o.e.aether packages with the exact same\n      version in OSGi metadata\n  * Improvement\n    + MRESOLVER-570: Remove excessive strictness of OSGi dependency\n      metadata\n  * Task\n    + MRESOLVER-576: Allow co-release of Resolver 1.x and 2.x\n\n- Upgrade to upstream version 1.9.20\n  * Bug\n    + MRESOLVER-483: PreorderNodeListGenerator bug: may print\n      trailing ':'\n    + MRESOLVER-522: File locking threads not entering critical\n      region were 'oversleeping'\n    + MRESOLVER-547: BF collector always copies artifacts, even\n      when it should not\n  * Improvement\n    + MRESOLVER-536: Skip setting last modified time when FS does\n      not support it\n\n- Add dependency on plexus-xml where relevant\n  * this will be needed for smooth upgrade to plexus-utils 4.0.0\n\n- Upgrade to upstream version 1.9.18\n  * Bug\n    + MRESOLVER-372: Sporadic AccessDeniedEx on Windows\n    + MRESOLVER-441: Undo FileUtils changes that altered non-Windows\n      execution path\n  * Improvement\n    + MRESOLVER-396: Native transport should retry on HTTP 429\n      (Retry-After)\n  * Task\n    + MRESOLVER-397: Deprecate Guice modules\n    + MRESOLVER-405: Get rid of component name string literals, make\n      them constants and reusable\n    + MRESOLVER-433: Expose configuration for inhibiting\n      Expect-Continue handshake in 1.x\n    + MRESOLVER-435: Refresh download page\n    + MRESOLVER-437: Resolver should not override given HTTP\n      transport default use of expect-continue handshake\n\n- Upgrade to upstream version 1.9.15\n  * Bug\n    + MRESOLVER-373: Remove lock upgrading code\n    + MRESOLVER-375: Several key aspects are broken in provided and\n      trusted checksum feature\n    + MRESOLVER-376: StackOverflowError at\n      BfDependencyCollector.processDependency\n    + MRESOLVER-380: Lock diagnostic: attempted lock step is\n      recorded, but on failed attempt is not removed\n    + MRESOLVER-393: Transport HTTP does not retain last modified as\n      sent by remote end\n  * Improvement\n    + MRESOLVER-220: Modify signaling for unsupported operations\n    + MRESOLVER-382: Define local outgoing (bind) address\n    + MRESOLVER-385: Reduce default value for\n      aether.connector.http.connectionMaxTtl\n  * Task\n    + MRESOLVER-378: Update parent POM to 40\n    + MRESOLVER-381: Undo MRESOLVER-373 as it was fixed by other\n      means\n    + MRESOLVER-386: Make all injected ctors public, deprecate all\n      def ctors\n    + MRESOLVER-388: Transport HTTP old codec proper override\n\n- Upgrade to upstream version 1.9.12\n  * Bug\n    + [MRESOLVER-371] Unjustified WARNING log added by\n      MRESOLVER-364\n    + [MRESOLVER-361] Unreliable TCP and retries on upload\n    + [MRESOLVER-357] ConflictResolver STANDARD verbosity\n      misbehaves\n    + [MRESOLVER-352] Duplicate METADATA_DOWNLOADING event is\n      being sent\n  * Improvement\n    + [MRESOLVER-360] disable checksum by default for .sigstore\n      in addition to .asc\n  * New Feature\n    + [MRESOLVER-370] Lock factory should dump lock states on\n      failure\n    + [MRESOLVER-353] Make aether.checksums.algorithms settable\n      per remote repository\n  * Task\n    + [MRESOLVER-366] Upgrade build plugins\n    + [MRESOLVER-364] Revert MRESOLVER-132\n    + [MRESOLVER-359] Make build be explicit about build time\n      requirements\n    + [MRESOLVER-356] Remove Guava (is unused)\n    + [MRESOLVER-354] Document expected checksums\n\n- Upgrade to upstream version 1.9.8\n  * Bug\n    + [MRESOLVER-345] Conflict resolution in verbose mode is\n      sensitive to version ordering\n    + [MRESOLVER-348] SslConfig httpSecurityMode change is not\n      detected\n    + [MRESOLVER-339] Preemptive Auth broken when default ports used\n    + [MRESOLVER-325] [REGRESSION] Suddenly seeing I/O errors under\n      windows aborting the build\n    + [MRESOLVER-330] Static name mapper is unusable with file-lock\n      factory\n    + [MRESOLVER-314] Getting 'IllegalArgumentException: Comparison\n      method violates its general contract!'\n    + [MRESOLVER-316] DF collector enters endless loop when\n      collecting org.webjars.npm:musquette:1.1.1\n    + [MRESOLVER-298] javax.inject should be provided or optional\n    + [MRESOLVER-305] Evaluate blocked repositories also when\n      retrieving metadata\n    + [MRESOLVER-309] PrefixesRemoteRepositoryFilterSource aborts\n      the build while it should not\n    + [MRESOLVER-313] Artifact file permissions are 0600 and not\n      implicitly set by umask\n    + [MRESOLVER-296] FileProcessor.write( File, InputStream ) is\n      defunct\n    + [MRESOLVER-292] Documented and used param names mismatch\n    + [MRESOLVER-294] Fix JapiCmp configuration and document it\n    + [MRESOLVER-285] File locking on Windows knows to misbehave\n    + [MRESOLVER-246] m-deploy-p will create hashes for hashes\n    + [MRESOLVER-265] Discrepancy between produced and recognized\n      checksums\n    + [MRESOLVER-241] Resolver checksum calculation should be driven\n      by layout\n    + [MRESOLVER-242] When no remote checksums provided by layout,\n      transfer inevitably fails/warns\n    + [MRESOLVER-250] Usage of descriptors map in DataPool prevents\n      gargabe collection\n  * New Feature\n    + [MRESOLVER-32] Support parallel artifact/metadata uploads\n    + [MRESOLVER-319] Support parallel deploy\n    + [MRESOLVER-297] Chained LRM\n    + [MRESOLVER-167] Support forcing specific repositories for\n      artifacts\n    + [MRESOLVER-268] Apply artifact checksum verification for any\n      resolved artifact\n    + [MRESOLVER-274] Introduce Remote Repository Filter feature\n    + [MRESOLVER-275] Introduce trusted checksums source\n    + [MRESOLVER-276] Resolver post-processor\n    + [MRESOLVER-278] BREAKING: Introduce RepositorySystem shutdown\n      hooks\n    + [MRESOLVER-236] Make it possible to resolve .asc on a 'fail'\n      respository.\n  * Improvement\n    + [MRESOLVER-346] Too eager locking\n    + [MRESOLVER-347] Better connection pool configuration (reuse,\n      max TTL, maxPerRoute)\n    + [MRESOLVER-349] Adapter when locking should 'give up and\n      retry'\n    + [MRESOLVER-350] Get rid of commons-lang dependency\n    + [MRESOLVER-327] Make tranport-http obey system properties\n      regarding proxy settings\n    + [MRESOLVER-340] Make WebDAV 'dance' disabled by default\n    + [MRESOLVER-341] Add option for preemptive PUT Auth\n    + [MRESOLVER-315] Implement preemptive authentication feature\n      for transport-http\n    + [MRESOLVER-328] The transport-http should be able to ignore\n      cert errors\n    + [MRESOLVER-337] Real cause when artifact not found with\n      repository filtering\n    + [MRESOLVER-287] Get rid of deprecated finalize methods\n    + [MRESOLVER-317] Improvements for BF collector\n    + [MRESOLVER-318] Cleanup redundant code and centralize executor\n      handling\n    + [MRESOLVER-303] Make checksum detection reusable\n    + [MRESOLVER-290] Improve file handling resolver wide\n    + [MRESOLVER-7] Download dependency POMs in parallel in BF\n      collector\n    + [MRESOLVER-266] Simplify adapter creation and align\n      configuration for it\n    + [MRESOLVER-269] Allow more compact storage of provided\n      checksums\n    + [MRESOLVER-273] Create more compact File locking layout/mapper\n    + [MRESOLVER-284] BREAKING: Some Sisu parameters needs to be\n      bound\n    + [MRESOLVER-286] Improve basic connector closed state handling\n    + [MRESOLVER-240] Using breadth-first approach to resolve Maven\n      dependencies\n    + [MRESOLVER-247] Avoid unnecessary dependency resolution by a\n      Skip solution based on BFS\n    + [MRESOLVER-248] Make DF and BF collector implementations\n      coexist\n  * Task\n    + [MRESOLVER-326] Resolver transport-http should retry on\n      failures\n    + [MRESOLVER-331] Make DefaultTrackingFileManager write directly\n      to tracking files\n    + [MRESOLVER-333] Distinguish better resolver errors for\n      artifact availability\n    + [MRESOLVER-320] Investigate slower resolving speeds as\n      reported by users\n    + [MRESOLVER-291] Undo MRESOLVER-284\n    + [MRESOLVER-279] Simplify and improve trusted checksum sources\n    + [MRESOLVER-281] Update configurations page with new elements\n    + [MRESOLVER-282] Drop PartialFile\n    + [MRESOLVER-230] Make supported checksum algorithms extensible\n    + [MRESOLVER-231] Extend “smart checksum” feature\n    + [MRESOLVER-234] Introduce “provided” checksums feature\n    + [MRESOLVER-237] Make all checksum mismatches handled same\n    + [MRESOLVER-239] Update and sanitize dependencies\n    + [MRESOLVER-244] Deprecate FileTransformer API\n    + [MRESOLVER-245] Isolate Hazelcast tests\n  * Dependency upgrade\n    + [MRESOLVER-311] Upgrade Parent to 39\n    + [MRESOLVER-293] Update dependencies, align with Maven\n    + [MRESOLVER-272] Update parent POM to 37, remove plugin version\n      overrides, update bnd\n    + [MRESOLVER-280] Upgrade invoker, install, deploy, require\n      maven 3.8.4+\n    + [MRESOLVER-251] Upgrade Redisson to 3.17.5\n    + [MRESOLVER-249] Update Hazelcast to 5.1.1 in\n      named-locks-hazelcast module\n\n- Add an alias for the wagon connector\n\n- Build against the standalone JavaEE modules unconditionally\n\n- Remove the javax.annotation:javax.annotation-api dependency on\n  distribution versions that do not incorporate the JavaEE modules\n\n- Add the glassfish-annotation-api jar to the build classpath\n\n- Upgrade to upstream version 1.7.3\n  * Bug\n    + [MRESOLVER-96] - Dependency Injection fails after upgrading\n      to Maven 3.6.2\n    + [MRESOLVER-153] - resolver-status.properties file is corrupted\n      due to concurrent writes\n    + [MRESOLVER-171] - Resolver fails when compiled on Java 9+ an\n      run on Java 8 due to JDK API breakage\n    + [MRESOLVER-189] - Using semaphore-redisson followed by\n      rwlock-redisson on many parallel build of the same project\n      triggers redisson error\n  * New Feature\n    + [MRESOLVER-90] - HTML content in POM: Maven should validate\n      content before storing in local repo\n    + [MRESOLVER-145] - Introduce more SyncContext implementations\n  * Improvement\n    + [MRESOLVER-103] - Replace deprecated HttpClient classes\n    + [MRESOLVER-104] - maven-resolver-demo-maven-plugin uses\n      reserved artifactId\n    + [MRESOLVER-147] - Upgrade to Java 8\n    + [MRESOLVER-148] - Use vanilla Guice 4 instead of forked\n      Guice 3\n    + [MRESOLVER-156] - Active dependency management for Google\n      Guice/Guava\n    + [MRESOLVER-168] - add DEBUG message when downloading an\n      artifact from repositories\n    + [MRESOLVER-193] - Properly type lock key names in Redis\n    + [MRESOLVER-197] - Minors improvements (umbrella)\n    + [MRESOLVER-204] - Add a SessionData#computeIfAbsent method\n    + [MRESOLVER-214] - Remove clirr configuration\n  * Task\n    + [MRESOLVER-141] - Review index-based access to collections\n    + [MRESOLVER-151] - Enforce a checksum policy to be provided\n      explicitly\n    + [MRESOLVER-152] - Perform null checks when interface\n      contracts require it\n    + [MRESOLVER-154] - Move SyncContextFactory interface to SPI\n      module\n    + [MRESOLVER-155] - Make TrackingFileManager member of\n      DefaultUpdateCheckManager\n    + [MRESOLVER-158] - Simplify SimpleDigest class\n    + [MRESOLVER-159] - Mark singleton components as Sisu Singletons\n    + [MRESOLVER-160] - Deprecate ServiceLocator\n    + [MRESOLVER-162] - Restore binary compatibility broken by\n      MRESOLVER-154\n    + [MRESOLVER-170] - Deprecate org.eclipse.aether.spi.log\n    + [MRESOLVER-172] - Make TrackingFileManager shared singleton\n      component\n    + [MRESOLVER-173] - Drop deprecated AetherModule\n    + [MRESOLVER-174] - Use all bindings in UTs and tests\n    + [MRESOLVER-175] - Drop SyncContextFactory delegates in favor\n      of a selector approach\n    + [MRESOLVER-177] - Move pre-/post-processing of metadata from\n      ResolveTask to DefaultMetadataResolver\n    + [MRESOLVER-183] - Don't require optional dependencies for\n      Redisson\n    + [MRESOLVER-184] - Destroy Redisson semaphores if not used\n      anymore\n    + [MRESOLVER-186] - Update Maven version in Resolver Demo\n      Snippets\n    + [MRESOLVER-188] - Improve documentation on using the named\n      locks with redis/hazelcast (umbrella)\n    + [MRESOLVER-190] - [Regression] Revert MRESOLVER-184\n    + [MRESOLVER-191] - Document how to analyze lock issues\n    + [MRESOLVER-196] - Document named locks configuration options\n    + [MRESOLVER-219] - Implement NamedLock with advisory file\n      locking\n    + [MRESOLVER-227] - Refactor NamedLockFactorySelector to a\n      managed component\n    + [MRESOLVER-232] - Make SimpleNamedLockFactorySelector logic\n      reusable\n  * Sub-task\n    + [MRESOLVER-198] - Replace assert by simpler but equivalent\n      calls\n    + [MRESOLVER-199] - Java 8 improvements\n    + [MRESOLVER-200] - Simplify conditions with the same result\n      and avoid extra validations\n    + [MRESOLVER-201] - Make variables final whenever possible\n    + [MRESOLVER-202] - Use isEmpty() instead length() \u003c= 0\n  * Dependency upgrade\n    + [MRESOLVER-185] - Upgrade Redisson to 3.15.6\n  * Change of API and incompatible with maven-resolver \u003c 1.7\n\n- Upgrade to upstream version 1.6.3\n  * Bug\n    + [MRESOLVER-153] - resolver-status.properties file is corrupted\n      due to concurrent writes\n    + [MRESOLVER-171] - Resolver fails when compiled on Java 9+ and\n      run on Java 8 due to JDK API breakage\n  * Improvement\n    + [MRESOLVER-168] - add DEBUG message when downloading an\n      artifact from repositories\n  * Task\n    + [MRESOLVER-177] - Move pre-/post-processing of metadata from\n      ResolveTask to DefaultMetadataResolver\n  * Needed for maven 3.8.4\n\n- Do not build/run the tests against the legacy guava20 package\n\n- Upgrade to upstream version 1.6.2\n  * Sub-task\n    + [MRESOLVER-139] - Make SimpleDigest use SHA-1 or MD5 only\n    + [MRESOLVER-140] - Default to SHA-1 and MD5 hashing algorithms\n  * Bug\n    + [MRESOLVER-25] - Resume support is broken under high\n      concurrency\n    + [MRESOLVER-114] - ArtifactNotFoundExceptions when building in\n      parallel\n    + [MRESOLVER-129] - Exclusion has no setters\n    + [MRESOLVER-137] - Make OSGi bundles reproducible\n    + [MRESOLVER-138] - MRESOLVER-56 introduces severe performance\n      regression\n  * New Feature\n    + [MRESOLVER-109] - AndDependencySelector should override\n      toString\n    + [MRESOLVER-115] - Make checksum algorithms configurable\n    + [MRESOLVER-123] - Provide a global locking sync context by\n      default\n    + [MRESOLVER-131] - Introduce a Redisson-based\n      SyncContextFactory\n    + [MRESOLVER-165] - Add support for mirror selector on\n      external:http:*\n    + [MRESOLVER-166] - Add support for blocked\n      repositories/mirrors\n  * Improvement\n    + [MRESOLVER-56] - Support SHA-256 and SHA-512 as checksums\n    + [MRESOLVER-116] - Add page with all supported configuration\n      options\n    + [MRESOLVER-125] - Use type conversions returning primitives\n    + [MRESOLVER-127] - Don't use boolean for property\n      'aether.updateCheckManager.sessionState'\n    + [MRESOLVER-136] - Migrate from maven-bundle-plugin to\n      bnd-maven-plugin\n  * Task\n    + [MRESOLVER-119] - Turn log messages to SLF4J placeholders\n    + [MRESOLVER-130] - Move GlobalSyncContextFactory to a separate\n      module\n    + [MRESOLVER-132] - Remove synchronization in\n      TrackingFileManager\n  * Dependency upgrade\n    + [MRESOLVER-105] - Update Plexus Components\n    + [MRESOLVER-106] - Update HttpComponents\n    + [MRESOLVER-107] - Update Wagon Provider API to 3.4.0\n    + [MRESOLVER-108] - Update mockito-core to 2.28.2\n    + [MRESOLVER-117] - Upgrade SLF4J to 1.7.30\n    + [MRESOLVER-118] - Upgrade Sisu Components to 0.3.4\n  * Needed for maven 3.8.x\n\n- Set buildshell to bash for '\u003c\u003c\u003c'.\n\n- Upgrade to upstream version 1.4.2\n  * Bug:\n    + MRESOLVER-38 – SOE/OOME in DefaultDependencyNode.accept\n  * Improvements:\n    + MRESOLVER-93 – PathRecordingDependencyVisitor to handle 3 cycles\n    + MRESOLVER-102 – make build Reproducible\n\n- Upgrade to upstream version 1.4.1\n  * Task\n    + [MRESOLVER-92] - Revert MRESOLVER-7\n  * Bug\n    + [MRESOLVER-86] - ResolveArtifactMojo from resolver example\n      uses plugin repositories to resolve dependencies\n  * New Feature\n    + [MRESOLVER-10] - New 'TransitiveDependencyManager'\n      supporting transitive dependency management\n    + [MRESOLVER-33] - New 'DefaultDependencyManager' managing\n      dependencies on all levels supporting transitive dependency\n      management\n  * Improvement\n    + [MRESOLVER-7] - Download dependency POMs in parallel\n    + [MRESOLVER-84] - Add support for 'release' qualifier\n    + [MRESOLVER-87] - Refresh examples to use maven-resolver\n      artifacts for demo\n    + [MRESOLVER-88] - Code style cleanup to use Java 7 features\n\n- Initial packaging of maven-resolver 1.3.1\n- Generate and customize the ant build files\n\n\n\nmaven-resolver was update to upstream version 1.9.27:\n\n  * Bug Fixes\n    + Sync TrackingFileManager with 2.x\n\n- Update to upstream version 1.9.26\n  * New features and improvements\n    + GH-1773: Treat 410 Gone as 404 Not Found\n    + GH-1737: Revert partially parallel upload change\n  * Bug Fixes\n    + GH-1768; Drastically simplify auth caching\n    + [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF\n  * Documentation updates\n    + Clarify that HTTP Transport uses Apache HTTP Client\n  * Dependency updates\n    + Bump org.redisson:redisson from 3.52.0 to 4.2.0\n    + Bump commons-codec:commons-codec from 1.20.0 to 1.21.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26\n      to 1.27\n    + Bump org.apache.maven:maven-parent from 46 to 47\n    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from\n      0.25.0 to 0.25.4\n    + Bump mavenVersion from 3.9.11 to 3.9.12\n\n- Update to upstream version 1.9.25\n  * New features and improvements\n    + Add scope support for trusted checksums\n    + Name mappers cleanup and new GAECV mapper\n    + Proper metadata locking support\n    + Ability to augment metadata nature for version range request\n  * Bug Fixes\n    + TrackingFileManager changes\n    + Maven filters daemon friendly\n    + Remove hack from Basic connector\n    + Fix locking issues\n  * Documentation updates\n    + Updated the documentation to reflect the current list of name\n      mappers\n  * Maintenance\n    + Mild backport: support same properties as Resolver 2.x\n    + Maven resolver lockrepro\n    + Bugfix: Java 25 broke test\n  * Dependency updates\n    + Bump com.github.siom79.japicmp:japicmp-maven-plugin from\n      0.23.1 to 0.25.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24\n      to 1.26\n    + Bump commons-codec:commons-codec from 1.18.0 to 1.20.0\n    + Bump org.redisson:redisson from 3.50.0 to 3.52.0\n    + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre\n    + Bump com.google.code.gson:gson from 2.13.1 to 2.13.2\n    + Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814\n    + Bump mavenVersion from 3.9.10 to 3.9.11\n\n- Update to upstream version 1.9.24\n  * New features and improvements\n    + Metadata type out of coordinates\n    + RFC9457 implementation\n    + Intern context strings\n  * Maintenance\n    + Align plexus-util version with Maven\n    + Align guice version with Maven\n    + Enable Github Issues (1.9.x branch)\n- Build also maven-resolver-supplier package in separate spec file\n\n- Add dependency on objectweb-asm to build with sisu 0.9.0.M4\n\n- Update to upstream version 1.9.23\n  * Bug\n    + MRESOLVER-659: NPE in trusted checksum post processor if\n  * Improvement\n    + MRESOLVER-680: Disable checksum by default for .sigstore.json\n      as well\n    + MRESOLVER-703: HTTP transport should expose config for max\n      redirects\n\n- Upgrade to upstream version 3.9.16\n  * Bug Fixes\n    + Trim threadConfiguration to accept input surrounded with\n      spaces\n    + Backport: Maven 3.10.x fixed plugin resolution\n  * Dependency updates\n    + Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to\n      2.11.0\n    + [3.9.x] Bump to parent POM 48\n    + Bump commons-io:commons-io from 2.21.0 to 2.22.0\n    + Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre\n    + Bump actions/cache from 5.0.4 to 5.0.5\n\n- There is no need to link the jansi-native library into the tree,\n  since our jansi java library will load it from the system anyway\n\n- Upgrade to upstream version 3.9.15\n  * Documentation updates\n    + Use new Maven logos in documentation\n    + document modelVersion only supported value: 4.0.0\n  * Dependency updates\n    + Bump actions/upload-artifact from 7.0.0 to 7.0.1\n    + Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1\n    + Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3\n    + Bump actions/cache from 5.0.3 to 5.0.4\n    + Bump actions/download-artifact from 8.0.0 to 8.0.1\n\n- Upgrade to upstream version 3.9.14\n  * Bug Fixes\n    + plexus-testing dependencies should be used in test scope\n  * Dependency updates\n    + Bump actions/upload-artifact from 6.0.0 to 7.0.0\n    + Bump actions/download-artifact from 7.0.0 to 8.0.0\n\n- Upgrade to upstream version 3.9.13\n  * Bug Fixes\n    + Bug: SecDispatcher is managed by legacy Plexus DI\n    + [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8\n      Java version in ranges as well\n  * Maintenance\n    + Update Maven plugin versions in default-bindings.xml\n    + Migrate to JUnit 5 - avoid using TestCase\n  * Dependency updates\n    + Maven Resolver 1.9.27\n    + Bump resolverVersion from 1.9.25 to 1.9.26\n    + Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0\n    + Bump actions/cache from 5.0.0 to 5.0.3\n    + Bump org.apache.maven:maven-parent from 45 to 47\n    + Bump actions/checkout from 6.0.1 to 6.0.2\n    + Bump actions/setup-java from 5.1.0 to 5.2.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26\n      to 1.27\n    + Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1\n      to 3.3.0\n    + Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0\n    + Bump org.ow2.asm:asm from 9.9 to 9.9.1\n    + Bump actions/upload-artifact from 5.0.0 to 6.0.0\n    + Bump actions/download-artifact from 6.0.0 to 7.0.0\n\n- Specify required maven-resolver version since the\n  maven-resolver-provider requires methods added in 1.9.25\n\n- Upgrade to upstream version 3.9.12\n  * New features and improvements\n    + Apply resolver changes and improvements\n    + Update formatting of prerequisites-requirements error to\n      improve readability\n    + Allow a Maven plugin to require a Java version\n    + Use MavenRepositorySystem in ProjectBuildingHelper instead\n      of deprecated RepositorySystem\n    + Make maven.config use UTF8\n    + Simplify prefix resolution\n  * Bug Fixes\n    + Add default implementation for new method in\n      MavenPluginManager\n    + Repository layout should be used in MavenRepositorySystem\n    + Fix plugin prefix resolution when metadata is not available\n      from repository\n    + Improve source root modification warning message\n    + Bug: bad cache isolation between two sessions\n    + Set Guice class loading to CHILD - avoid using terminally\n      deprecated methods\n    + Avoid parsing MAVEN_OPTS (3.9.x)\n  * Documentation updates\n    + clarify repository vs deployment repository\n    + add maintained branches\n  * Maintenance\n    + Add IntelliJ icon\n    + Build by JDK 25\n    + Deprecate org.apache.maven.repository.RepositorySystem in\n      3.9.x\n  * Build\n    + Bump actions/download-artifact from 5.0.0 to 6.0.0\n    + Bump actions/upload-artifact from 4.6.2 to 5.0.0\n  * Dependency updates\n    + Bump actions/cache from 4.2.3 to 5.0.0\n    + Bump resolverVersion from 1.9.24 to 1.9.25\n    + Bump actions/checkout from 5.0.0 to 6.0.1\n    + Bump actions/setup-java from 5.0.0 to 5.1.0\n    + Bump commons-cli:commons-cli from 1.9.0 to 1.11.0\n    + Bump org.codehaus.plexus:plexus-interpolation from 1.28 to\n      1.29\n    + Bump commons-io:commons-io from 2.19.0 to 2.21.0\n    + Bump xmlunitVersion from 2.10.3 to 2.11.0\n    + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24\n      to 1.26\n    + Bump org.ow2.asm:asm from 9.8 to 9.9\n    + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre\n\n- Upgrade to upstream version 3.9.11\n  * New features and improvements\n    + Augment version range resolution used repositories\n  * Bug Fixes\n    + Deduplicate filtered dependency graph\n    + Move ensure in boundaries of project lock\n  * Maintenance\n    + [MNGSITE-393] - remove references to Maven 2\n    + Update CONTRIBUTING after GitHub issues enabled\n    + Enable Github Issues\n    + [MNG-8763] - Remove name from site bannerLeft\n  * Build\n    + Pin GitHub action versions by hash\n    + Build the project by JDK 21 as default\n    + Use Maven 3.9.10 for build on GitHub\n\n- Upgrade to upstream version 3.9.10\n  * Bug\n    + MNG-8096: Inconsistent dependency resolution behaviour for\n      concurrent multi-module build can cause failures\n    + MNG-8169: MINGW support requires\n      --add-opens java.base/java.lang=ALL-UNNAMED\n    + MNG-8170: Maven 3.9.8 contains weird native library for Jansi\n      on Windows/arm64\n    + MNG-8211: Maven should fail builds that use CI Friendly\n      versions but have no values set\n    + MNG-8248: WARNING: A restricted method in java.lang.System has\n      been called\n    + MNG-8256: ProjectDependencyGraph bug: in case of filtering,\n      non-direct module links are lost\n    + MNG-8315: Failure of mvn.cmd if a .mvn directory is located at\n      drive root\n    + MNG-8396: Maven takes forever to resume\n    + MNG-8711: 'Duplicate artifact' in LifecycleDependencyResolver\n  * Improvement\n    + MNG-8370: Introduce maven.repo.local.head\n    + MNG-8399: JDK 24+ issues warning about usage of\n      sun.misc.Unsafe\n    + MNG-8707: Add methods to remove compile and test source roots\n    + MNG-8712: improve dependency version explanation: it's a\n      requirement, not always effective version\n    + MNG-8717: Remove maven-plugin-plugin:addPluginArtifactMetadata\n      from default binding\n    + MNG-8722: Use a single standalone version of asm\n    + MNG-8731: Use https for xsi:schemaLocation in generated\n      descriptors\n    + MNG-8734: Simplify scripting like 'get project version' cases\n  * Task\n    + MNG-8728: Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use\n      Java 24 on CI\n\n- Link also the objectweb-asm/asm to the lib directory\n\n    + MNG-8177: Warning\n\n\nxmvn-connector was updated to fix:\n\n- Add dependency on objectweb-asm to build with sisu 0.9.0.M4\n\n- Upgrade to version 4.3.0\n  * Changes:\n    + Fix typo in JavadocMojo\n    + Reproducible javadoc\n    + Reproducible manifest injection\n    + Deprecate UUIDs\n    + Implement MetadataResult.getPackageMetadataMap()\n\n\nxmvn-mojo was updated to fix:\n\nUpgrade to version 4.3.0\n\n  * Changes:\n    + Fix typo in JavadocMojo\n    + Reproducible javadoc\n    + Reproducible manifest injection\n    + Deprecate UUIDs\n    + Implement MetadataResult.getPackageMetadataMap()\n  \nxmvn-parent was updated to fix:\n\n- Upgrade to version 4.3.0\n  * Changes:\n    + Fix typo in JavadocMojo\n    + Reproducible javadoc\n    + Reproducible manifest injection\n    + Deprecate UUIDs\n    + Implement MetadataResult.getPackageMetadataMap()\n  \nxmvn-tools was updated to:\n\n- The new commons-compress needs commons-lang3\n\n- Upgrade to version 4.3.0\n  * Changes:\n    + Fix typo in JavadocMojo\n    + Reproducible javadoc\n    + Reproducible manifest injection\n    + Deprecate UUIDs\n    + Implement MetadataResult.getPackageMetadataMap()\n\nxmvn was updated to fix:\n\n- Adapt to no libjansi.so linked into the arch independent path\n\n- Fix build after removal of the default %%{java_home} define\n\n- Upgrade to version 4.3.0\n  * Changes:\n    + Fix typo in JavadocMojo\n    + Reproducible javadoc\n    + Reproducible manifest injection\n    + Deprecate UUIDs\n    + Implement MetadataResult.getPackageMetadataMap()\n  \n","status":"published","published":"2026-07-28T15:40:01Z","modified":"2026-07-29T09:00:07.639085413Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8364-1","title":"libcommons-lang-java, libcommons-lang3-java vulnerability","description":"It was discovered that Apache Commons Lang incorrectly handled recursion\nin the ClassUtils.getClass method. An attacker could possibly use this\nissue to cause Apache Commons Lang to crash, resulting in a denial of\nservice.","status":"published","published":"2026-06-02T12:42:11Z","modified":"2026-06-02T18:33:01.121648834Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}