{"id":"SUSE-SU-2026:21996-1","summary":"Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec","details":"This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:\n\nChanges in apache-commons-lang3:\n\nUpdate to 3.20.0\n\n  * New features:\n\n    + Add SystemProperties.getPath(String, Supplier\u003cPath\u003e)\n    + Add JavaVersion.JAVA_25\n    + Add JavaVersion.JAVA_26\n    + Add SystemUtils.IS_JAVA_25\n    + Add SystemUtils.IS_JAVA_26\n    + Add MutablePair.ofNonNull(Map.Entry)\n    + Add TimedSemaphore.builder(), Builder, and deprecate\n      constructors\n    + LANG-1504: Adding labels and history to split StopWatch\n\n  * Fixed Bugs:\n\n    + Optimize ObjectToStringComparator.compare() method\n    + [javadoc] Improve StringUtils Javadoc\n    + Fix internal inverted logic in private isEnum() method and\n      correct its usage in getFirstEnum()\n    + Use accessors in ToStringStyle so subclasses can effectively\n      override them\n    + 'LocaleUtils.toLocale(String)' for a 2 letter country code\n      now returns a value instead of throwing an\n      'IllegalArgumentException'\n    + Fix typo in StringUtils.trunctate() IllegalArgumentException\n      message and test assertion messages\n    + Fix test fixture in\n      ReflectionDiffBuilderTest.testTransientFieldDifference()\n    + LANG-1789: NullPointerException when generating\n      NoSuchMethodException in MethodUtils\n    + LANG-1786: Map deprecated TimeZone short IDs and avoid JRE\n      WARNINGs to the console\n    + LANG-1792: TypeUtils.toString() skips angle brackets for Class\n      type\n    + Mention JDK 25 LTS as a tested version in the release notes\n  * Changes:\n    + Bump org.apache.commons:commons-parent from 88 to 92\n\n- Update to 3.19.0\n\n  * New features:\n\n    + Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH\n    + Add SystemUtils.IS_OS_NETWARE\n    + Add MethodUtils.getAccessibleMethod(Class, Method)\n    + Add documentation to site for CVE-2025-48924\n      ClassUtils.getClass(...) can throw a StackOverflowError on\n      very long inputs\n    + Add StringUtils.indexOfAny(CharSequence, int, char...)\n    + Add ConcurrentException.ConcurrentException(String)\n    + Add DateUtils.toLocalDateTime(Date[, TimeZone])\n    + Add DateUtils.toOffsetDateTime(Date[, TimeZone])\n    + Add DateUtils.toZonedDateTime(Date[, TimeZone])\n    + Add ByteConsumer\n    + Add ByteSupplier\n    + Add FailableByteConsumer\n    + Add FailableByteSupplier\n    + LANG-1784: Add Functions methods for null-safe mapping and\n      chaining\n    + LANG-1784: Add Failable methods for null-safe mapping and\n      chaining\n    + Add DoubleRange.fit(double)\n    + Add IntegerRange.fit(int)\n    + Add LongRange.fit(long)\n    + Add DurationUtils.get(String, TemporalUnit, long)\n    + Add DurationUtils.getMillis(String, long)\n    + Add DurationUtils.getSeconds(String, long)\n    + Add SystemProperties.getBoolean(Class, String, boolean)\n    + Add SystemProperties.getInt(Class, String, int)\n    + Add SystemProperties.getLong(Class, String, long)\n\n  * Fixed Bugs:\n\n    + LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the\n      hierarchy of methods\n    + MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...) now\n      returns null instead of throwing a NullPointerException, as it\n      does for other exception types\n    + Reduce spurious failures in ArrayUtilsTest methods that test\n      ArrayUtils.shuffle() methods\n    + MethodUtils cannot find or invoke a public method on a public\n      class implemented in its package-private superclass\n    + AtomicSafeInitializer.get() can spin internally if the\n      FailableSupplier given to AbstractConcurrentInitializer\n      .AbstractBuilder.setInitializer(FailableSupplier) throws a\n      RuntimeException\n    + LANG-1783: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + LANG-1782: MethodUtils cannot find or invoke vararg methods\n      without providing vararg types or values\n    + MethodUtils cannot find or invoke vararg methods of interface\n      types\n    + MethodUtils cannot find or invoke vararg methods when widening\n      primitive types following the JLS 5.1.2. Widening Primitive\n      Conversion\n    + LANG-1597: Invocation fails because matching varargs method\n      found but then discarded\n    + Don't check accessibility twice in MemberUtils\n      .setAccessibleWorkaround(T)\n    + LANG-1774: Improve handling of ClassUtils\n      .getShortCanonicalName() for invalid input\n    + LANG-1720: Improve Javadocs for Conversion\n    + Fix CalendarUtils.toLocalDate() Javadoc return type\n      description\n    + Fix the method name in Javadoc examples for CharUtils.isHex()\n    + Deprecate NumberUtils.compare(byte, byte) in favor of\n      Byte.compare(byte, byte)\n    + Deprecate NumberUtils.compare(int, int) in favor of\n      Integer.compare(int, int)\n    + Deprecate NumberUtils.compare(long, long) in favor of\n      Long.compare(long, long)\n    + Deprecate NumberUtils.compare(short, short) in favor of\n      Short.compare(short, short)\n    + Deprecate obsolete system property constant\n      SystemProperties.AWT_TOOLKIT\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_FONTS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_GRAPHICSENV\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_HEADLESS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_AWT_PRINTERJOB\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_COMPILER\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_ENDORSED_DIRS\n    + Deprecate obsolete system property constant\n      SystemProperties.JAVA_EXT_DIRS\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getAwtToolkit()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtFonts()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtGraphicsenv()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtHeadless()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaAwtPrinterjob()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaCompiler()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaEndorsedDirs()\n    + Deprecate method for obsolete system property constant\n      SystemProperties.getJavaExtDirs()\n    + Deprecate method for obsolete system property constant\n      SystemUtils.isJavaAwtHeadless()\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_FONTS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_GRAPHICSENV\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_HEADLESS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_AWT_PRINTERJOB\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_COMPILER\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_ENDORSED_DIRS\n    + Deprecate constants for obsolete system property\n      SystemUtils.JAVA_EXT_DIRS\n    + [javadoc] General improvements\n    + [javadoc] Fix thrown exception documentation for\n      MethodUtils.getMethodObject(Class\u003c?\u003e, String, Class\u003c?\u003e...)\n    + [javadoc] Strings::equalsAny: CI doc string should show it's\n      insensitive\n    + [javadoc] General Javadoc improvements\n    + LANG-1780: [javadoc] Fix Strings Javadoc\n    + [javadoc] Fix typo in Javadoc of Strings instances\n    + [javadoc] Fix Javadocs in ClassUtils\n    + [javadoc] Fix @deprecated link for StringUtils#startsWithAny\n    + Replace old feather logotype with new oak logotype\n  * Changes:\n    + [test] Bump org.apache.commons:commons-text from 1.13.1 to\n      1.14.0\n    + Bump org.apache.commons:commons-parent from 85 to 88\n\n- Update to 3.18.0\n\n- Fix component version in default.properties to 3.12\n\n    * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.\n    * Add FailableShortSupplier, handy for JDBC APIs.\n    * Add JavaVersion.JAVA_17.\n    * Add StringUtils.substringBefore(String, int).\n    * Add Range.INTEGER.\n    * Add DurationUtils.\n    * Correct implementation of RandomUtils.nextLong(long, long).\n    * Update maven-surefire-plugin 2.22.2 -\u003e 3.0.0-M5.\n    * Bump junit-bom from 5.7.0 to 5.7.1.\n    * Ignored exception 'ignored', should not be called so.\n    * Change array style from 'int a[]' to 'int[] a'.\n\nChanges in apache-commons-text:\n\n- Upgrade to version 1.15.0\n\n  * New features\n\n    + Add experimental CycloneDX VEX file\n    + TEXT-235: Add Damerau-Levenshtein distance\n    + Add unit tests to increase coverage\n    + Add new test for CharSequenceTranslator#with()\n    + Add tests and assertions to org.apache.commons.text.similarity\n      to get to 100% code coverage\n\n  * Fixed Bugs\n\n    + Fix exception message typo in XmlStringLookup\n      .XmlStringLookup(Map, Path...)\n    + TEXT-236: Inserting at the end of a TextStringBuilder throws\n      a StringIndexOutOfBoundsException\n    + Fix TextStringBuilderTest.testAppendToCharBuffer() to use\n      proper argument type\n    + Fix Apache RAT plugin console warnings\n    + Fix site XML to use version 2.0.0 XML schema\n    + Removed unreachable threshold verification code in\n      src/main/java/org/apache/commons/text/similarity\n    + Enable secure processing for the XML parser in XmlStringLookup\n      in case the underlying JAXP implementation doesn't\n\n- Upgrade to version 1.14.0\n\n  * New features\n\n    + Interface StringLookup now extends UnaryOperator\u003cString\u003e\n    + Interface TextRandomProvider extends IntUnaryOperator\n    + Add RandomStringGenerator.Builder\n      .usingRandom(IntUnaryOperator)\n    + Add PMD check to default Maven goal\n    + Add org.apache.commons.text.RandomStringGenerator.Builder\n      .setAccumulate(boolean)\n\n  * Fixed Bugs\n\n    + Fix PMD UnnecessaryFullyQualifiedName in StringLookupFactory\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      DefaultStringLookupsHolder\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      PropertiesStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      JavaPlatformStringLookup\n    + Fix PMD UnnecessaryFullyQualifiedName in StringSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in StrSubstitutor\n    + Fix PMD UnnecessaryFullyQualifiedName in AlphabetConverter\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in\n      TextStringBuilder\n    + Fix PMD AvoidBranchingStatementAsLastInLoop in StrBuilder\n    + org.apache.commons.text.translate.LookupTranslator\n      .LookupTranslator(Map CharSequence\u003e) now throws\n      NullPointerException instead of\n      java.security.InvalidParameterException\n\n- Upgrade to version 1.13.1\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Deprecate EntityArrays.EntityArrays()\n    + StringLookupFactory.DefaultStringLookupsHolder\n      .createDefaultStringLookups() maps DefaultStringLookup\n      .LOCAL_HOST twice instead of once for LOCAL_HOST and\n      LOOPBACK_ADDRESS\n\n- Upgrade to version 1.13.0\n\n  * New features\n\n    + Add StringLookupFactory.loopbackAddressStringLookup()\n    + Add StringLookupFactory.KEY_LOOPBACK_ADDRESS\n    + Add DefaultStringLookup.LOOPBACK_ADDRESS\n    + Add richer inputs in package org.apache.commons.text\n      .similarity with SimilarityInput\n    + Add HammingDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardDistance.apply(SimilarityInput, SimilarityInput)\n    + Add JaccardSimilarity.apply(SimilarityInput, SimilarityInput)\n    + Add JaroWinklerDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add JaroWinklerSimilarity.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDetailedDistance.apply(SimilarityInput,\n      SimilarityInput)\n    + Add LevenshteinDistance.apply(SimilarityInput,\n      SimilarityInput)\n\n  * Fixed Bugs\n\n    + Fix build on Java 22\n    + Fix build on Java 23-ea\n    + Make package-private constructor private:\n      StrLookup.MapStrLookup.MapStrLookup(Map)\n    + Make package-private constructor private: StrLookup\n      .SystemPropertiesStrLookup.SystemPropertiesStrLookup()\n    + Make package-private class private and final: MapStrLookup\n    + Make package-private class private: StrMatcher.CharMatcher\n    + Make package-private class private: StrMatcher.CharSetMatcher\n    + Make package-private class private: StrMatcher.NoMatcher\n    + Make package-private class private: StrMatcher.StringMatcher\n    + Make package-private class private: StrMatcher.TrimMatcher\n    + Make package-private class private and final:\n      IntersectionSimilarity.BagCount\n    + Make package-private class private and final:\n      IntersectionSimilarity.TinyCount\n    + Deprecate LevenshteinDistance.LevenshteinDistance() in favor\n      of LevenshteinDistance.getDefaultInstance()\n    + Deprecate LevenshteinDetailedDistance\n      .LevenshteinDetailedDistance() in favor of\n      LevenshteinDetailedDistance.getDefaultInstance()\n    + TEXT-234: Improve StrBuilder documentation for new line text\n    + TEXT-234: Improve TextStringBuilder documentation for new line\n      text\n    + TEXT-233: Required OSGi Import-Package version numbers in\n      MANIFEST.MF\n\n- Upgrade to version 1.12.0\n\n  * New features\n\n    + Add StringLookupFactory.fileStringLookup(Path...) and\n      deprecated fileStringLookup()\n    + Add StringLookupFactory.propertiesStringLookup(Path...) and\n      deprecated propertiesStringLookup()\n    + Add StringLookupFactory.xmlStringLookup(Map, Path...) and\n      deprecated xmlStringLookup() and xmlStringLookup(Map)\n    + Add StringLookupFactory.builder() for fencing Path resolution\n      of the file, properties and XML lookups\n    + Add DoubleFormat.Builder.get() as Builder now implements\n      Supplier\n\n  * Fixed Bugs\n\n    + TEXT-232: WordUtils.containsAllWords?() may throw\n      PatternSyntaxException\n    + TEXT-175: Fix regression for determining whitespace in\n      WordUtils\n    + Deprecate Builder in favor of Supplier\n\n- Upgrade to version 1.11.0\n\n  * New features\n\n    + TEXT-224: Set SecureProcessing feature in XmlStringLookup by\n      default\n    + TEXT-224: Add StringLookupFactory.xmlStringLookup(Map\u003cString,\n      Boolean\u003e...)\n    + Add @FunctionalInterface to FormatFactory\n    + Add RandomStringGenerator.builder()\n    + TEXT-229: Add XmlEncoderStringLookup/XmlDecoderStringLookup\n    + Add StringSubstitutor.toString()\n\n  * Fixed Bugs\n\n    + TEXT-219: Fix StringTokenizer.getTokenList to return an\n      independent modifiable list\n    + Fix Javadoc for StringEscapeUtils.escapeHtml4\n    + TextStringBuidler#hashCode() allocates a String on each call\n    + TEXT-221: Fix Bundle-SymbolicName to use the package name\n      org.apache.commons.text\n    + Add and use a package-private singleton for RegexTokenizer\n    + Add and use a package-private singleton for CosineSimilarity\n    + Add and use a package-private singleton for\n      LongestCommonSubsequence\n    + Add and use a package-private singleton for\n      JaroWinklerSimilarity\n    + Add and use a package-private singleton for JaccardSimilarity\n    + [StepSecurity] ci: Harden GitHub Actions\n    + Improve AlphabetConverter Javadoc\n    + Fix exception message in IntersectionResult to make\n      set-theoretic sense\n    + Add null-check in RandomStringGenerator#Builder#selectFrom()\n      to avoid NullPointerException\n    + Add null-check in RandomStringGenerator#Builder#withinRange()\n      to avoid NullPointerException\n    + TEXT-228: Fix TextStringBuilder to over-allocate when ensuring\n      capacity\n    + Constructor for ResourceBundleStringLookup should be private\n      instead of package-private\n    + Constructor for UrlDecoderStringLookup should be private\n      instead of package-private\n    + Constructor for UrlEncoderStringLookup should be private\n      instead of package-private\n    + TEXT-230: Javadoc of org.apache.commons.text.lookup\n      .DefaultStringLookup.XML is incorrect\n    + Update DoubleFormat to state it is based on Double.toString\n\n    + Removed non-existing parameter from Javadocs and spelled out\n    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin\n    + Refactor TextStringBuilder.readFrom(Readable), extracting\n    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,\n    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],\n\nChanges in apache-commons-configuration2:\n\n- Upgrade to version 2.15.0\n\n  * Changes\n\n    + Disable include schemes http[s] by default, see\n      AbstractFileLocationStrategy\n    + Detect and avoid processing cycles in YAML input\n      (YAMLConfiguration) (bsc#1265299, CVE-2026-45205)\n    + Extend scheme validation to inner schemes of jar: URLs\n\n- Upgrade to version 2.14.0\n\n  * New features\n\n    + Add XMLConfiguration.read(Element)\n    + Add ConfigurationException.ConfigurationException(String,\n      Object...)\n    + Add ConfigurationException.ConfigurationException(Throwable,\n      String, Object...)\n    + Add ConversionException.ConversionException(String, Object...)\n    + Add ConversionException.ConversionException(Throwable, String,\n      Object...)\n    + Add ConfigurationRuntimeException\n      .ConfigurationRuntimeException(Throwable, String, Object...)\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + Migrate from deprecated APIs\n\n- Upgrade to version 2.13.0\n\n  * New features\n\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .entrySet()\n    + Add org.apache.commons.configuration2.ImmutableConfiguration\n      .forEach(BiConsumer\u003cString, Object\u003e)\n    + Add VEX entry for CVE-2025-48924\n\n  * Fixed Bugs\n\n    + Shared primitive variable \"throwExceptionOnMissing\" in one\n      thread may not yield the value of the most recent write from\n      another thread [org.apache.commons.configuration2\n      .AbstractConfiguration] At AbstractConfiguration.java:\n      [line 1493] AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + Shared primitive variable \"forceSingleLine\" in one thread may\n      not yield the value of the most recent write from another\n      thread [org.apache.commons.configuration2\n      .PropertiesConfigurationLayout]\n      At PropertiesConfigurationLayout.java:[line 821]\n      AT_STALE_THREAD_WRITE_OF_PRIMITIVE\n    + CONFIGURATION-849: Fix undoubling of strings\n    + CONFIGURATION-852: Mark the package jakarta.servlet.* import\n      as optional in OSGi\n    + Fix build [WARNING] Parameter 'forkMode' is unknown for plugin\n      'maven-surefire-plugin:3.5.3:test (default-test)'\n\n- Upgrade to version 2.12.0\n\n  * New features:\n\n    + Add PrefixedKeysIterator.toString() to package-private\n      PrefixedKeysIterator\n    + CONFIGURATION-836: New web configurations using the\n      jakarta.servlet namespace are now available\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletContextConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletFilterConfiguration\n    + CONFIGURATION-836: Add org.apache.commons.configuration2.web\n      .JakartaServletRequestConfiguration\n    + Add org.apache.commons.configuration2\n      .AbstractHierarchicalConfiguration.getKeysInternal(String,\n      String)\n\n  * Fixed Bugs:\n\n    + PropertyConverter.to(Class, Object, DefaultConversionHandler)\n      doesn't convert custom java.lang.Number subclasses\n    + DefaultConversionHandler.convertValue(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + DefaultConversionHandler.to(Object, Class,\n      ConfigurationInterpolator) doesn't convert custom java.lang\n      .Number subclasses\n    + CONFIGURATION-848: SubsetConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + CONFIGURATION-848: CompositeConfiguration does not account for\n      delimiters as it did in 2.9.0\n    + Describe the security model\n    + De-emphasize the 1.x version line on the website\n    + CONFIGURATION-851: HomeDirectoryLocationStrategy no longer\n      resolves the user HOME directory correctly\n\n- Upgrade to version 2.11.0\n\n  * New features\n\n    + CONFIGURATION-844: Add support for empty sections\n    + Add ImmutableConfiguration.containsValue(Object)\n\n  * Fixed Bugs\n\n    + Fail-fast with a NullPointerException if DataConfiguration\n      .DataConfiguration(Configuration) is called with null\n    + Fail-fast with a NullPointerException if\n      XMLPropertiesConfiguration.XMLPropertiesConfiguration(Element)\n      is called with null\n    + Fail-fast with a NullPointerException if a SubsetConfiguration\n      constructor is called with a null Configuration\n    + CONFIGURATION-843: Methods should not be empty\n    + Guard MapConfiguration against null maps\n    + Fail-fast with a NullPointerException if\n      AppletConfiguration(Applet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletConfiguration(ServletConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(Servlet) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletContextConfiguration(ServletContext) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletFilterConfiguration(FilterConfig) is called with null\n    + Fail-fast with a NullPointerException if\n      ServletRequestConfiguration(ServletRequest) is called with\n      null\n    + Deprecate DatabaseConfiguration.getDatasource() in favor of\n      getDataSource()\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractImmutableNodeHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      AbstractListDelimiterHandler\n    + Fix PMD DynamicCombinedConfiguration in\n      DefaultPrefixLookupsHolder\n    + Fix PMD DynamicCombinedConfiguration in\n      DynamicCombinedConfiguration\n    + Fix PMD DynamicCombinedConfiguration in\n      PropertiesConfiguration\n    + CONFIGURATION-846: Restore previous behavior allowing Spring\n      to inject multiple values\n    + CONFIGURATION-847: Property with an empty string value was not\n      processed\n\nChanges in apache-commons-cli:\n\n- Update to 1.11.0\n\n  * New Features\n\n    + Add CommandLine.getOptionCount() to measure option repetition\n\n  * Fixed Bugs\n\n    + CLI-351: Multiple trailing BREAK_CHAR_SET characters cause\n      infinite loop in HelpFormatter\n    + CLI-351:  Fix issue with groups not being reported in help\n      output\n\nChanges in apache-commons-io:\n\n- Upgrade to 2.22.0\n\n  * New features\n\n    + Add and use IOUtils.closeQuietlySuppress(Closeable, Throwable)\n    + Add ProxyWriter.setReference(Writer)\n    + Add ProxyWriter.unwrap()\n    + Add ProxyReader.setReference(Reader)\n    +Add ProxyReader.unrwap()\n    + IO-883: ByteArraySeekableByteChannel should optionally\n      configure a read-only channel\n    + IO-883: Add ByteArraySeekableByteChannel.Builder and builder()\n    + IO-883: Add AbstractStreamBuilder.getByteArray()\n    + CloseShieldInputStream now supports a custom close shield as\n      a function\n    + Add FlushShieldOutputStream to workaround issues in generic\n      code that ends up calling third parties like like\n      org.tukaani.xz.LZMAOutputStream.flush()\n    + Add filter channels\n\n  * Fixed Bugs\n\n    + Fix Apache RAT plugin console warnings\n    + ByteArraySeekableByteChannel.position(long) and truncate(long)\n      shouldn't throw an IllegalArgumentException for a new positive\n      position that's too large\n    + Fix malformed Javadoc comments\n    + ReadAheadInputStream.close() doesn't always close its filtered\n      input stream\n    + ReadAheadInputStream now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + FileAlterationMonitor.stop(long) now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + FileCleaningTracker now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThreadMonitor.run() now restores the current thread's\n      interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() now restores the current\n      thread's interrupt flag when catching InterruptedException\n    + ThrottledInputStream.throttle() doesn't preserve the original\n      InterruptedException as the cause of its\n      InterruptedIOException\n    + All thread names are now prefixed with \"commons-io-\"\n    + IO-639: ReversedLinesFileReader does not read first line if\n      its empty\n    + IO-886: Fixed incorrect regular expression in\n      PathUtils.RelativeSortedPaths.extractKey(String, String)\n    + Fix typos in Javadoc of FileUtils and related test classes\n    + IO-887: WriterOutputStream from a builder fails on malformed\n      or unmappable input bytes\n    + BoundedReader now extends ProxyReader\n    + AbstractStreamBuilder.setOpenOptions(OpenOption...) now makes\n      a defensive copy of its input array\n    + IO-885: Path visits follow links\n    + BOMInputStream fail-fast and tracks its ByteOrderMark as a final\n    + Refactor UnixLineEndingInputStream and\n      WindowsLineEndingInputStream for duplication\n    + IO-857: [Javadoc] PathUtils.cleanDirectory() methods vs FileUtils\n    + Fix JaCoCo report generation (code coverage)\n    + AbstractStreamBuilder.setBufferSizeDefault(int) now resets to\n      default for input less than or equal to zero\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 91 to 98\n    + Bump commons-codec:commons-codec from 1.19.0 to 1.21.0\n    + Bump commons.bytebuddy.version from 1.17.8 to 1.18.8\n    + Bump commons-lang3 from 3.19.0 to 3.20.0\n\nChanges in apache-commons-codec:\n\n- Update to 1.22.0\n\n  * New features\n\n    + CODEC-326: Add Base58 support\n    + Add BaseNCodecInputStream.AbstracBuilder.setByteArray(byte[])\n    + CODEC-335: Add GitIdentifiers to compute Git blob and tree\n      object identifiers\n\n  * Fixed Bugs\n\n    + CODEC-249: Fix Incorrect transform of CH digraph according\n      Metaphone basic rules #423\n    + CODEC-317: ColognePhonetic can create duplicate consecutive\n      codes in some cases\n    + Add boundary tests for BinaryCodec.fromAscii partial-bit\n      inputs #425\n    + CODEC-336: Base64.Builder.setUrlSafe(boolean) Javadoc\n      incorrectly states null is accepted for primitive boolean\n      parameter\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 96 to 98\n\n- Update to 1.21.0\n\n  * New features\n\n    + CODEC-333: Add distinct Base64 decoding for standard and\n      URL-safe formats\n\n  * Fixed Bugs\n\n    + Fix oak leaf icon references in overview.html when running\n      'mvn clean javadoc:javadoc'\n    + Fix Apache RAT plugin console warnings\n    + Fix malformed Javadoc comments\n  * Changes\n    + Bump org.apache.commons:commons-parent from 91 to 96 #415,\n      #418\n    + Bump commons-io:commons-io from 2.20.0 to 2.21.0\n    + Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0\n\n- Update to 1.20.0\n\n  * New features\n\n    + Add org.apache.commons.codec.digest.Crc16\n    + Add builders to org.apache.commons.codec.digest streams and\n      deprecate some old constructors\n    + Add builder to Base16 streams and deprecate some old\n      constructors\n    + Add support for SHAKE128-256 and SHAKE256-512 to 'DigestUtils'\n      and 'MessageDigestAlgorithms' on Java 25 and up\n    + Add BaseNCodec.AbstractBuilder.setDecodeTable(byte[]) and\n      refactor subclasses\n\n  * Changes\n\n    + Deprecate all but one Base32 constructor in favor of the\n      builder added in version 1.17.0\n    + Deprecate all but one Base64 constructor in favor of the\n      builder added in version 1.17.0\n    + BaseNCodecInputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + BaseNCodecOutputStream subclasses are now type-safe to match\n      its matching BaseNCodec\n    + Bump org.apache.commons:commons-parent from 85 to 91\n    + [test] Bump org.apache.commons:commons-lang3 from 3.18.0 to\n      3.19.0\n\n- Update to 1.19.0\n\n  * New features\n\n    + Add HmacUtils.hmac(Path)\n    + Add HmacUtils.hmacHex(Path)\n    + Add PMD check to the default Maven goal\n    + Add SpotBugs check to the default Maven goal\n\n  * Fixed Bugs\n\n    + Remove -nouses directive from maven-bundle-plugin. OSGi\n      package imports now state 'uses' definitions for package\n      imports, this doesn't affect JPMS\n      (from org.apache.commons:commons-parent:80)\n    + Refactor DigestUtils.updateDigest(MessageDigest, File) to use\n      NIO\n    + CODEC-328:  Clarify Javadoc for\n      org.apache.commons.codec.digest.UnixCrypt.crypt(byte[],String)\n    + Precompile regular expressions in DaitchMokotoffSoundex.Rule\n    + Precompile regular expressions in\n      DaitchMokotoffSoundex.parseRules(Scanner, String, Map, Map)\n    + Precompile regular expressions in\n      Lang.loadFromResource(String, Languages)\n    + Precompile regular expressions in\n      PhoneticEngine.encode(String, LanguageSet)\n    + Precompile regular expressions in\n      org.apache.commons.codec.language.bm.Rule.parse*(*)\n    + Remove redundant checks for whitespace in\n      DaitchMokotoffSoundex.soundex(String, boolean)\n    + Javadoc typo in Base16.java #380\n    + Deprecate unused constant org.apache.commons.codec.language.bm\n      .Rule.ALL\n    + CODEC-331: org.apache.commons.codec.language.bm.Rule\n      .parsePhonemeExpr(String) adds duplicate empty phoneme when\n      input ends with |\n    + CODEC-331: org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String) does not remove special\n      characters like punctuation\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.binary.StringUtils\n    + Fix PMD UnusedFormalParameter in private constructor in\n      org.apache.commons.codec.binary.Base16\n    + Fix PMD multiple UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Blake3\n    + Fix PMD UnnecessaryFullyQualifiedName in\n      org.apache.commons.codec.digest.Md5Crypt\n    + Fix PMD EmptyControlStatement in\n      org.apache.commons.codec.language.Metaphone\n    + Fix SpotBugs [ERROR] Medium: org.apache.commons.codec.binary\n      .BaseNCodec$AbstractBuilder.setEncodeTable(byte[]) may expose\n      internal representation by storing an externally mutable\n      object into BaseNCodec$AbstractBuilder.encodeTable [org.apache\n      .commons.codec.binary.BaseNCodec$AbstractBuilder] At\n      BaseNCodec.java:[line 131] EI_EXPOSE_REP2\n    + The method org.apache.commons.codec.binary.BaseNCodec\n      .AbstractBuilder.setLineSeparator(byte...) now makes a\n      defensive copy\n    + Avoid unnecessary String conversion in\n      org.apache.commons.codec.language.bm.PhoneticEngine\n      .applyFinalRules(PhonemeBuilder, Map)\n    + Fix SpotBugs [ERROR] High: Potentially dangerous use of\n      non-short-circuit logic in org.apache.commons.codec.language\n      .DaitchMokotoffSoundex.cleanup(String)\n      [org.apache.commons.codec.language.DaitchMokotoffSoundex] At\n      DaitchMokotoffSoundex.java:[line 350]\n      NS_DANGEROUS_NON_SHORT_CIRCUIT\n\n  * Changes\n\n    + Bump org.apache.commons:commons-parent from 79 to 85 #375\n    + [test] Bump commons-io:commons-io from 2.18.0 to 2.20.0\n    + [test] Bump org.apache.commons:commons-lang3 from 3.17.0 to\n      3.18.0 #386\n\n- Update to 1.16.0:\n\n  * Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.\n\n    + Support java.nio.ByteBuffer in\n\n  * Fixed bugs:\n\n- Don't condition the maven defines on release version, but on\n\n  + Add Daitch-Mokotoff Soundex\n  + Make possible to provide padding byte to BaseNCodec in constructor\n    urlSafe parameter\n    is mandatory to call close()\n  + Add support for HMAC Message Authentication Code (MAC) digests\n  + Beider Morse Phonetic Matching producing incorrect tokens\n    using empty strings\n    Issue: CODEC-184.\n  + Fix Javadoc 1.8.0 errors\n  + Fix Java 8 build Javadoc errors\n    Issue: CODEC-189.\n  + Deprecate Charsets Charset constants in favor of Java 7's\n    java.nio.charset.StandardCharsets\n    Issue: CODEC-178.\n  + Update from commons-parent 34 to 35\n    Issue: CODEC-190.\n\n- update to 1.8\n  * Add DigestUtils.updateDigest(MessageDigest, InputStream)\n  * Add Match Rating Approach (MRA) phonetic algorithm encoder\n  * ColognePhonetic encoder unnecessarily creates many char arrays on every loop run\n- add junit4 to fix a build fail\n- update to 1.6, sync with Fedora\n","modified":"2026-06-09T18:24:42.828540141Z","published":"2026-05-29T08:47:36Z","related":["CVE-2025-48924","CVE-2026-45205"],"upstream":["CVE-2025-48924","CVE-2026-45205"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621996-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265299"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-48924"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-45205"}],"affected":[{"package":{"name":"apache-commons-cli","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-cli&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-codec","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-codec&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-io":"2.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-configuration2","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-configuration2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-io","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-io&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-codec":"1.22.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-lang3","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-lang3&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-text":"1.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-text","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/apache-commons-text&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-text":"1.15.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-cli","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-cli&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-text":"1.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-codec","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-codec&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-configuration2","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-configuration2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-io":"2.22.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-io","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-io&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-lang3","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-lang3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1","apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}},{"package":{"name":"apache-commons-text","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/apache-commons-text&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"apache-commons-lang3-javadoc":"3.20.0-160000.1.1","apache-commons-text-javadoc":"1.15.0-160000.1.1","apache-commons-codec-javadoc":"1.22.0-160000.1.1","apache-commons-codec":"1.22.0-160000.1.1","apache-commons-cli":"1.11.0-160000.1.1","apache-commons-configuration2":"2.15.0-160000.1.1","apache-commons-io-javadoc":"2.22.0-160000.1.1","apache-commons-cli-javadoc":"1.11.0-160000.1.1","apache-commons-io":"2.22.0-160000.1.1","apache-commons-configuration2-javadoc":"2.15.0-160000.1.1","apache-commons-text":"1.15.0-160000.1.1","apache-commons-lang3":"3.20.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21996-1.json"}}],"schema_version":"1.7.5"}