Most recent entries from all

EUVD-2026-228854

fkie_cve-2022-36437

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

GHSA-c5hg-mr8r-f6jp — Hazelcast connection caching

Affected: Maven: com.hazelcast:hazelcast, Maven: com.hazelcast.jet:hazelcast-jet, Maven: com.hazelcast.jet:hazelcast-jet-enterprise, Maven: com.hazelcast:hazelcast-enterprise

### Impact The Connection handler in Hazelcast and Hazelcast Jet allows an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. The affected Hazelcast versions are through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

### Patches Hazelcast Jet (and Enterprise) 4.5.4. Hazelcast IMDG (and Enterprise)3.12.13 Hazelcast IMDG (and Enterprise) 4.1.10 Hazelcast IMDG (and Enterprise) 4.2.6 Hazelcast Platform (and Enterprise) 5.1.3

### Workarounds There is no known workaround, but setups with TLS and mutual authentication enabled significantly lowers the exploitation risk.

### References https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437

gsd-2022-36437

RHSA-2023:0483 — Red Hat Security Advisory: Red Hat Fuse 7.11.1.P1 security update

hazelcast: Hazelcast connection caching CXF: directory listing / code exfiltration CXF: SSRF Vulnerability

WID-SEC-W-2023-0317 — Red Hat FUSE: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat FUSE ausnutzen, um Dateien zu manipulieren.