[BUG] Opensearch 3.2.0 has a vulnerability CVE-2025-48924.

[shlwb0]

Describe the bug

Opensearch 3.2.0 only fixed commons-lang3 and did not fix common-lang.

opensearch-3.2.0/plugins/opensearch-knn/commons-lang-2.6.jar

Related component

Plugins

To Reproduce

Scan 3.2.0 image.

Expected behavior

fix opensearch-3.2.0/plugins/opensearch-knn/commons-lang-2.6.jar

Additional Details

No response

[sandeshkr419]

@shlwb0 Given 3.3 is scheduled to release this week, I don't think this will be backported in a 3.2.x release for now.

@peterzhuamazon Can we validate if we fixed this in 3.3.0?