{
  "cveId": "CVE-2025-53192",
  "url": "https://patchblox.com/security/cve/CVE-2025-53192",
  "summary": "CVE-2025-53192 is fixed in 2 products on 1 platform, first by SUSE-SU-2025:03285-1, released September 21, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mybatis: This update for mybatis, ognl fixes the following issues:\n\nVersion update to 3.5.7:\n\n  * Bug fixes:\n\n    \u002B Improved p...",
  "description": "This update for mybatis, ognl fixes the following issues:\n\nVersion update to 3.5.7:\n\n  * Bug fixes:\n\n    \u002B Improved performance under JDK 8. #2223\n\nVersion update to 3.5.8:\n\n  * List of changes:\n\n    \u002B Avoid NullPointerException when mapping an empty string to\n      java.lang.Character. #2368\n    \u002B Fixed an incorrect argument when initializing static object.\n      This resolves a compatibility issue with quarkus-mybatis.\n      #2284\n    \u002B Performance improvements. #2297 #2335 #2340\n\nVersion update to 3.5.9:\n\n  * List of changes:\n\n    \u002B Add nullable to \u003Cforeach /\u003E. If enabled, it skips the\n      iteration when the collection is null instead of throwing an\n      exception. To enable this feature globally, set\n      nullableOnForEach=true in the config. #1883\n\nVersion update to 3.5.10:\n\n  * Bug fixes:\n\n    \u002B Unexpected illegal reflective access warning (or\n      InaccessibleObjectException on Java 16\u002B) when calling method\n      in OGNL expression. #2392\n    \u002B IllegalAccessException when auto-mapping Records (JEP-359)\n      #2195\n    \u002B \u0027interrupted\u0027 status is not set when\n       PooledConnection#getConnection() is interrupted. #2503\n\n  * Enhancements:\n\n    \u002B A new option argNameBasedConstructorAutoMapping is added. If\n      enabled, constructor argument names are used to look up\n      columns when auto-mapping. #2192\n    \u002B Added a new property skipSetAutoCommitOnClose to\n      JdbcTransactionFactory. Skipping setAutoCommit() call could\n      improve performance with some drivers. #2426\n    \u002B \u003CidArg /\u003E can now be listed after \u003Carg /\u003E in \u003Cconstructor /\u003E.\n      #2541\n\nVersion update to 3.5.11:\n\n  * Bug fixes:\n\n    \u002B OGNL could throw IllegalArgumentException when invoking\n      inherited method. #2609\n    \u002B returnInstanceForEmptyRow is not applied to constructor\n      auto-mapping. #2665\n\nVersion update to 3.5.12\n\n  * User impactful changes\n\n    \u002B #2703 Referencing collection parameter by name fails fixing\n      #2693\n    \u002B #2709 Fix a race condition caused by other threads calling\n      mapper methods while mapped tables are being constructed\n    \u002B #2727 Enable ability to provide custom configuration to\n      XMLConfigBuilder\n    \u002B #2731 Adding mapper could fail under JPMS\n    \u002B #2741 Add \u0027affectedData\u0027 attribute to @select,\n      @SelectProvider, and \u003Cselect /\u003E\n    \u002B #2767 Resolve resultType by namespace and id when not\n      provided resultType and resultMap\n    \u002B #2804 Search readable property when resolving constructor arg\n      type by name\n    \u002B Minor correction: \u0027boolean\u0027 can never be null (primative)\n    \u002B General library updates\n    \u002B Uses parameters option for compiler now (needed by spring boot\n      3) (for reflection needs)\n\n  * Code cleanup\n\n    \u002B #2816 Use open rewrite to partially cleanup java code\n    \u002B #2817 Add private constructors per open rewrite\n    \u002B #2819 Add final where appropriate per open rewrite\n    \u002B #2825 Cleanup if statement breaks / return logic\n    \u002B #2826 Eclipse based cleanup\n\n  * Build\n\n    \u002B #2820 Remove test ci group profile in favor of more direct\n      usage on GH-Actions and update deprecated surefire along in\n      overview in README.md\n    \u002B Adjustments to build so shaded ognl and javassist no longer\n      throw warnings\n    \u002B Build with jdk 21-ea as well now\n    \u002B Various test cleanup, updates, and additions\n    \u002B Turn on auto formatting of all java code including note to\n      contributors on readme to skip formatting when necessary in\n      code blocks\n    \u002B Tests may use jdk 11 now while retaining jdk 8 runtime\n    \u002B Pom cleanup / better clarification on parameters\n\n  * Documentation\n\n    \u002B Various documentation updates\n\nVersion update to 3.5.13:\n\n  * Bug fix:\n\n    \u002B Unable to resolve result type when the target property has\n      a getter with different return type #2834\n\nVersion update to 3.5.14:\n\n  * Bug fixes:\n\n    \u002B Registered type handler is not used for anonymous enums #2956\n    \u002B Discriminator does not work in constructor mapping #2913\n\nVersion update to 3.5.15:\n\n  * Changes\n\n    \u002B XNode#toString() should output all child nodes. See #3001 and\n      associated tickets on this issue\n    \u002B Fix performance of mappedColumnNames.contains by using \u0027set\u0027\n      rather than \u0027list\u0027. See #3023\n    \u002B Fix osgi issue with javassist. See #3031\n    \u002B Updated shaded OGNL to 3.4.2. See #3035\n    \u002B Add support method for generating dynamic sql on SQL class.\n      See #2887\n    \u002B General library updates\n    \u002B General document updates\n\n  * Build\n\n    \u002B We now show builds from java 11, 17, 21, and 22 on Github\n      Actions. Code is still java 8 compatible at this time.\n    \u002B Update vulnerable hsqldb to 2.7.2 fixing our tests that now\n      work due to newer support. Note, users were never affected by\n      this but at least one user pull request was attempted opened\n      in addition to both renovate and dependabot and various\n      reporting on it.\n    \u002B Now using more properties to define versions in pom to lower\n      the frequency of pull requests from renovate\n\nVersion update to 3.5.16:\n\n  * Security:\n\n    \u002B Prevent Invocation from being used by vulnerable applications.\n      #3115\n\n  * Bugs:\n\n    \u002B When database ID resolution is failed, invalid bound statement\n      is used. #3040\n\n  * Enhancements:\n\n    \u002B It is now possible to write a custom map wrapper to customize\n      how to map column name with dots or brackets. #13 #3062\n\n  * Performance:\n\n    \u002B Improved compatibility with Virtual Threads introduced by\n      Loom.\n    \u002B Reduced memory footprint when performing the default (i.e.\n      order based) constructor auto-mapping. #3113\n\n  * Build:\n\n    \u002B Include the shaded libraries (OGNL and Javassist) in the\n      sources.jar.\n\nVersion update to 3.5.17:\n\n  * Bugs:\n\n    \u002B VendorDatabaseIdProvider#getDatabaseId() should return product\n      name when properties is empty #3297\n    \u002B Update NClobTypeHandler to use methods for national character\n      set #3298\n\n  * Enhancements:\n\n    \u002B Allow DefaultSqlSessionFactory to provide a custom\n      SqlSession #3128\n\nVersion update to 3.5.18:\n\n  * Regressions\n\n    \u002B Fixed issue in 3.5.17 #3334\n\n  * New\n\n    \u002B Ignore empty xnode per #3349\n    \u002B Share expression validator #3339\n    \u002B Throw helpful error instead of IndexOutOfBoundsException\n      (automapping) #3327\n    \u002B Optimize mapper builder #3252\n\n  * Tests\n\n    \u002B Add TransactionFactory, Transaction test cases #3277\n\n  * Build\n\n    \u002B Reworked pom to match current java 17 build usage\n    \u002B Moved all tests to newer java standards\n    \u002B Cleaned up github actions\n    \u002B Run \u0027site\u0027 branch only on release commits\n\nVersion update to 3.5.19:\n\n  * Revert Regression introduced by #3349.\n\n- Initial packaging with version 3.4.7\n\nognl replaces the EOLed apache-commons-ognl that has an unpatched\n  security bug (bsc#1248252, CVE-2025-53192)",
  "published": "2025-09-21T09:18:07Z",
  "severity": "",
  "epss": 0.00623,
  "epssPercentile": 0.50148,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "mybatis",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.5.19-150200.5.9.1",
      "fix": "SUSE-SU-2025:03285-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-03285-1",
      "released": "2025-09-21T09:18:07Z"
    },
    {
      "platform": "linux",
      "product": "ognl",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.4.7-150200.5.3.1",
      "fix": "SUSE-SU-2025:03285-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-03285-1",
      "released": "2025-09-21T09:18:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}