"Commons"? Fortunately, not universal. Naming a library "commons" does not make it part of the language. All those Apache Commons libraries share one thing: they are mostly collections of anti-patterns. Stuff that can often be done better without dependencies, with real standard libraries (part of the platform) instead of collections of trees of mutually-incompatible libraries that look as written by a lazy first-year student. They feature null checks that make it obvious that the lazy programmer that use them consider null and empty as equivalent, which should in itself raise red lights. At best, they reinvent the wheel, quite often in a bad way. Those dependencies are something you won't find in my projects, and the first thing I remove from projects that I have to take over.
Whoever depends on this deserved those things.
I'd need to read TFA more extensively, but is there any bug report open for the concerned app servers?