---
id: "CVE-2022-42889"
kind: "vulnerability"
aliases: ["CVE-2022-42889"]
title: "Apache Commons Text: crafted input triggers dynamic property evaluation"
severity: "critical"
cvss: 9.8
epss: 0.99931
exploited: false
status: "open"
category: "package"
products: [{"name": "apache commons text", "fixed": ["1.10.0"], "affected": ">= 1.5, < 1.10.0", "ecosystem": "vendor"}, {"name": "netapp bluexp", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "juniper security threat response manager", "fixed": ["7.5.0"], "affected": "< 7.5.0", "ecosystem": "vendor"}, {"name": "juniper security threat response manager", "fixed": [], "affected": "= 7.5.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-commons-text", "aws", "java", "juniper-strm", "lab-disclosure", "maven", "netapp-bluexp", "package"]
not_affected_if: ["commons-text-1.10.0-or-later", "commons-text-below-1.5"]
published_at: "2022-10-13T13:15:10+00:00"
first_seen_at: "2026-10-24T17:33:06+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html", "first_seen_at": "2026-10-24T17:33:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42889", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-42889", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Apache Commons Text: crafted input triggers dynamic property evaluation

Apache Commons Text, a Java library, performs variable interpolation that dynamically evaluates and expands properties in text. The sources rate this critical (CVSS 9.8) but do not describe the full impact or attack conditions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache commons text affected >= 1.5, < 1.10.0 fixed 1.10.0
- vendor:netapp bluexp affected ? fixed ?
- vendor:juniper security threat response manager affected < 7.5.0 fixed 7.5.0
- vendor:juniper security threat response manager affected = 7.5.0 fixed ?

## How to check

- Look for `commons-text` in Java dependency files (pom.xml, build.gradle, lock files) and check whether the version is at least `1.5` and below `1.10.0`.
- Check vendor products listed as affected (Juniper Security Threat Response Manager below `7.5.0`) against their release notes; NetApp BlueXP status is unknown.

## Fix

- Upgrade Apache Commons Text to `1.10.0` or later.
- Juniper Security Threat Response Manager: move to `7.5.0`, per the sources.
- NetApp BlueXP: unknown; check the vendor advisory.

## Timeline

- 2026-10-24T17:33:06+00:00 lab https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html — AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-42889
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-42889

## Documents

- [advisory] AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html

## From the sources

AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director

Introducing a new console experience for AWS WAF

You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. 

# AWS Managed Rules changelog

This section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.

###### Note

This changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.

For the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at 

AWS Support Center

. 

| Rule group and rules | Description | Date |
| --- | --- | --- |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |
| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |
| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |
| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |
| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |
| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |
| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |
| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |
| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |
| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |
| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |
| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |
| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |
| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |
| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |
| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | R

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_