Commons itself has been around for awhile, but it looks like Commons Text was first released in 2017: https://commons.apache.org/proper/commons-text/changes-re

Commons itself has been around for awhile, but it looks like Commons Text was first released in 2017: https://commons.apache.org/proper/commons-text/changes-report.html https://commons.apache.org/proper/commons-text/changes-repor... If I read the disclosure correctly, it's been vulnerable for four of the five years it's been publicly available.