> This is very similar to the log4j vuln or not? Yes, it appears similar. It involves string interpolation that leads to arbitrary code execution via crafted

> This is very similar to the log4j vuln or not? Yes, it appears similar. It involves string interpolation that leads to arbitrary code execution via crafted values. It's also similar in that Apache Commons components are widespread and deeply embedded in innumerable backend systems. I wonder how widespread this particular Commons component is in real world. I can't recall ever explicitly seeking it out as a direct dependency myself. However, it is probably a common transitory dependency. It shows up as being used by a few thousand other Java components on mvnrepository.com, although at first glance I didn't see things in the list of usages that made me panic. The ones that stick out are Commons JPA, Apache ServiceMix and Apache Turbine and Struts 2. Disclaimer: The above is not comprehensive. Just me clicking around a few minutes. Don't bet your career on it.