[CVE-2025-48734] HIGH: commons-beanutils 1.9.4 - PropertyUtilsBean enum suppression
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
Research direction
Locate the dependency declaration that brings commons-beanutils 1.9.4 into workers.jar. Start by checking the project’s Java dependency files, update it to the fixed 1.11.0 version, and rerun the container vulnerability scan to confirm CVE-2025-48734 is no longer reported.
Written by the indexing model from the issue text.
Description
Vulnerability Report
| Field | Value |
|---|---|
| CVE | CVE-2025-48734 |
| Severity | HIGH |
| Library | commons-beanutils:commons-beanutils |
| Source | workers.jar |
| Installed Version | 1.9.4 |
| Fixed Version | 1.11.0 |
Summary
Apache Commons BeanUtils: PropertyUtilsBean does not suppress an enum's declaredClass property.
References
Filed from container vulnerability scan of workers.jar
- Dominant language
- Java
- Stars
- 15
- Forks
- 10
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from conductor-oss/java-sdk
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
conductor-oss/java-sdk#135 ·
-
EXCLUSIVE_JOIN task: missing builder class; defaultExclusiveJoinTask unreachablePossibly taken A pull request linked to this issue is open or already merged. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
conductor-oss/java-sdk#133 ·
-
HUMAN task: missing builder classPossibly taken @v1r3n claimed this 60 days ago. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 92/100
conductor-oss/java-sdk#132 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
conductor-oss/java-sdk#131 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
conductor-oss/java-sdk#130 ·
All issues in conductor-oss/java-sdk
Similar issues
-
[destination-snowflake] Custom domains rejected unlike source connectionsPossibly taken @kuza55 claimed this today. Openautoteam community connectors/destination/snowflake team/use
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
area-dashboard
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
component/operate kind/feature-request
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Forge coverage prompts carry text the agent cannot act onPossibly taken @graalvmbot claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
oracle/graalvm-reachability-metadata#10572 ·
Maintainers usually reply within 1 day
-
[CI] Core CI doesn't run for changes to amoro-format-lance (and amoro-web)Possibly taken @MarkAlex1234 claimed this today. Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 2 days