Live › vulnerability › CVE-2022-42889
Go to dashboardApache Commons Text, a Java library, performs variable interpolation that dynamically evaluates and expands properties in text. The sources rate this critical (CVSS 9.8) but do not describe the full impact or attack conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 17:33 UTC, 1h before NVD. All times on this page are UTC.
Teams whose Java applications depend on Apache Commons Text versions from 1.5 up to but not including 1.10.0, including through transitive dependencies, and who pass untrusted input into its interpolation features. Teams on 1.10.0 or later, or with no Commons Text dependency, can skip it. The sources do not say which default configurations or input paths are exploitable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache commons text | vendor | >= 1.5, < 1.10.0 | 1.10.0 |
| netapp bluexp | vendor | – | – |
| juniper security threat response manager | vendor | < 7.5.0 | 7.5.0 |
| juniper security threat response manager | vendor | = 7.5.0 | – |
commons-text in Java dependency files (pom.xml, build.gradle, lock files) and check whether the version is at least 1.5 and below 1.10.0.7.5.0) against their release notes; NetApp BlueXP status is unknown.1.10.0 or later.7.5.0, per the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director
Introducing a new console experience for AWS WAF
You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console.
This section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.
This changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.
For the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at
AWS Support Center
.
| Rule group and rules | Description | Date |
|---|---|---|
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended | Released static version 2.4 of this rule group. The new PHP2Shell_BODY_Extended rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY | Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |
| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly. For more information, see Bot Control labels. | 2026-10-15 |
SQL database managed rule group This release updates the following rules: SQLi_BODY SQLiExtendedPatterns_QUERYARGUMENTS SQLiExtendedPatterns_BODY SQLiExtendedPatterns_HEADER SQLiExtendedPatterns_URIPATH | Released static version 2.5 of this rule group. Updated the SQLi_BODY rule and all SQLiExtendedPatterns rules to reduce false positives and improve detection. | 2026-09-16 |
Core rule set (CRS) managed rule group This release updates the following rules: CrossSiteScripting_BODY CrossSiteScripting_COOKIE CrossSiteScripting_QUERYARGUMENTS CrossSiteScripting_URIPATH | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |
SQL database managed rule group This release updates the following rules: SQLi_COOKIE SQLi_URIPATH SQLi_QUERYARGUMENTS SQLi_BODY SQLiExtendedPatterns_QUERYARGUMENTS SQLiExtendedPatterns_BODY SQLiExtendedPatterns_HEADER SQLiExtendedPatterns_URIPATH | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |
| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |
Core rule set (CRS) managed rule group GenericLFI_QUERYARGUMENTS GenericLFI_URIPATH GenericLFI_BODY | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |
Known bad inputs managed rule group ReactJSRCE_BODY | Released static version 1.26 of this rule group. Added the REMOVE_NULLS text transformation to the listed rule. | 2026-07-15 |
Windows operating system managed rule group WindowsShellCommands_HEADER WindowsShellCommands_URIPATH WindowsShellCommands_BODY WindowsShellCommands_QUERYARGUMENTS WindowsShellCommands_QUERYSTRING | Released static version 2.5 of this rule group. Removed WindowsShellCommands_QUERYARGUMENTS and replaced it with WindowsShellCommands_QUERYSTRING. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |
| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |
SQL database managed rule group SQLi_COOKIE SQLi_URIPATH SQLi_QUERYARGUMENTS SQLi_BODY SQLiExtendedPatterns_QUERYARGUMENTS SQLiExtendedPatterns_BODY SQLiExtendedPatterns_HEADER SQLiExtendedPatterns_URIPATH | Released static version 2.3 of this rule group. Added new rules SQLiExtendedPatterns_HEADER and SQLiExtendedPatterns_URIPATH. Added REPLACE_COMMENTS text transformations to all rules. Added JS_DECODE text transformations to SQLi_COOKIE, SQLi_URIPATH, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |
Windows operating system managed rule group WindowsShellCommands_HEADER WindowsShellCommands_COOKIE WindowsShellCommands_URIPATH WindowsShellCommands_BODY WindowsShellCommands_QUERYARGUMENTS | Released static version 2.4 of this rule group. Removed WindowsShellCommands_COOKIE and replaced it with WindowsShellCommands_HEADER which matches on all headers. Added new rule WindowsShellCommands_URIPATH. Added JSON body inspection to the WindowsShellCommands_BODY. Added double URL_DECODE_UNI and JS_DECODE text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |
Core rule set (CRS) managed rule group RestrictedExtensions_QUERYARGUMENTS RestrictedExtensions_URIPATH | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |
PHP application managed rule group PHPHighRiskMethodsVariables_BODY PHPHighRiskMethodsVariables_QUERYSTRING PHPHighRiskMethodsVariables_HEADER PHPHighRiskMethodsVariables_URIPATH | Released static version 2.2 of this rule group. Improved detections and added PHPHighRiskMethodsVariables_URIPATH rule. | 2026-03-24 |
AWS WAF Bot Control rule group New rules: CategoryPagePreview CategoryWebhooks | R |
This page as .md · .json · in your agent: get_signal("CVE-2022-42889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.