Refine your search

3 vulnerabilities found for by hazelcast

CVE-2026-107726 (GCVE-0-2026-107726)
Vulnerability from cvelistv5
Published
2026-10-08 22:08
Modified
2026-10-09 15:12
Severity ?
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-20 - Improper Input Validation
Summary
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
References
Impacted products
Vendor Product Version
hazelcast hazelcast Version: < 5.4.5
Version: >= 5.5.0, < 5.5.10
Version: >= 5.6.0, < 5.6.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T15:07:22.266395Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:12:52.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hazelcast",
          "vendor": "hazelcast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 5.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.6.0, \u003c 5.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member\u0027s Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:08:09.553Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j"
        },
        {
          "name": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"
        },
        {
          "name": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6v25-8wq6-xq4j",
        "discovery": "UNKNOWN"
      },
      "title": "Hazelcast: Arbitrary member memory access by low-privileged client"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107726",
    "datePublished": "2026-10-08T22:08:09.553Z",
    "dateReserved": "2026-10-08T17:21:52.976Z",
    "dateUpdated": "2026-10-09T15:12:52.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107725 (GCVE-0-2026-107725)
Vulnerability from cvelistv5
Published
2026-10-08 22:04
Modified
2026-10-09 14:53
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
Summary
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
References
Impacted products
Vendor Product Version
hazelcast hazelcast Version: < 5.4.5
Version: >= 5.5.0, < 5.5.10
Version: >= 5.6.0, < 5.6.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T14:51:55.522210Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T14:53:26.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hazelcast",
          "vendor": "hazelcast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 5.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.6.0, \u003c 5.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:04:28.446Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8"
        },
        {
          "name": "https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"
        }
      ],
      "source": {
        "advisory": "GHSA-w294-6q5q-53p8",
        "discovery": "UNKNOWN"
      },
      "title": "Hazelcast: Authorization bypass in IMap Predicates API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107725",
    "datePublished": "2026-10-08T22:04:28.446Z",
    "dateReserved": "2026-10-08T17:21:52.976Z",
    "dateUpdated": "2026-10-09T14:53:26.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-0265 (GCVE-0-2022-0265)
Vulnerability from cvelistv5
Published
2022-03-03 21:40
Modified
2024-08-02 23:25
Severity ?
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-611 - Improper Restriction of XML External Entity Reference
Summary
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
References
Impacted products
Vendor Product Version
hazelcast hazelcast/hazelcast Version: 5.1-BETA-1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:25:38.846Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hazelcast/hazelcast",
          "vendor": "hazelcast",
          "versions": [
            {
              "status": "affected",
              "version": "5.1-BETA-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-08T09:15:46.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748"
        }
      ],
      "source": {
        "advisory": "d63972a2-b910-480a-a86b-d1f75d24d563",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Restriction of XML External Entity Reference in hazelcast/hazelcast",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0265",
          "STATE": "PUBLIC",
          "TITLE": "Improper Restriction of XML External Entity Reference in hazelcast/hazelcast"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "hazelcast/hazelcast",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.1-BETA-1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "hazelcast"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611 Improper Restriction of XML External Entity Reference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563"
            },
            {
              "name": "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748",
              "refsource": "MISC",
              "url": "https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748"
            }
          ]
        },
        "source": {
          "advisory": "d63972a2-b910-480a-a86b-d1f75d24d563",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0265",
    "datePublished": "2022-03-03T21:40:10.000Z",
    "dateReserved": "2022-01-17T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:25:38.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}