[CVE-2025-48734] HIGH: commons-beanutils 1.9.4 - PropertyUtilsBean enum suppression

[nthmost-orkes]

Vulnerability Report

Field	Value
CVE	CVE-2025-48734
Severity	HIGH
Library	commons-beanutils:commons-beanutils
Source	workers.jar
Installed Version	1.9.4
Fixed Version	1.11.0

Summary

Apache Commons BeanUtils: PropertyUtilsBean does not suppress an enum's declaredClass property.

References

• NVD Entry

---

Filed from container vulnerability scan of workers.jar

[nthmost-orkes]

Fix PR: conductor-oss/conductor#800 (pins commons-beanutils to 1.11.0 via Gradle dependency constraints)