CVE-2022-37021 json
Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
published 2022-08-31 4 y ago modified 2026-06-17 4 mo ago also GHSA-q4q3-r45f-7gwg , EUVD-2022-6906
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
Patch / fix
- maven org.apache.geode:geode-core 1.12.16, 1.13.5, 1.14.1
Exploit prediction
2.64% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.geode:geode-core | <1.12.16 >=1.13.0, <1.13.5 >=1.14.0, <1.14.1 |
1.12.16 1.13.5 1.14.1 |
Affected products
- Apache Software Foundation Apache Geode
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
lists.apache.org
/thread/qrvhmytsshsk5xcb68pwccw3y6m8o8nr
web, mailing-list, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-37021
advisory
Sources
- CVE List CVE-2022-37021
- GitHub Advisory GHSA-q4q3-r45f-7gwg
- NVD CVE-2022-37021
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.