Deserialization of untrusted data in com.google.code.gson:gson
Priority MEDIUM 50CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Partial Red Hat: 12 fixed, 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.1223 96th percentileScored 2026-11-07
Fix Partial com.google.code.gson:gson: 2.8.9com.google.code.gson:gson (Maven): 2.8.9Red Hat: 12 advisoriesRed Hat: 12 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | com.google.code.gson:gson | before 2.8.9 | 2.8.9 | Patch available | CNA |
| — | com.google.code.gson:gson (Maven) | before 2.8.9 | 2.8.9 | Patch available | GHSA-4jrv-ppp4-jm57 |
- com.google.code.gson:gson Vendor— Affected before 2.8.9 Fixed in 2.8.9 Patch available CNA
- com.google.code.gson:gson (Maven) Vendor— Affected before 2.8.9 Fixed in 2.8.9 Patch available GHSA-4jrv-ppp4-jm57
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:google:gson:*:*:*:*:*:*:*:* | 2.2.3 to before 2.8.9 | Vulnerable | |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:* | 20.3.6 | Vulnerable | Oracle |
- cpe:2.3:a:google:gson:*:*:*:*:*:*:*:* Versions 2.2.3 to before 2.8.9 Vulnerable ·Google
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:* Versions 20.3.6 Vulnerable ·Oracle
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:* | 21.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:* | 22.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:* | 18.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:* Versions 21.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:* Versions 22.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
Remediation
- Fix · CNA com.google.code.gson:gson Fixed in 2.8.9
- Fix · GHSA-4jrv-ppp4-jm57 com.google.code.gson:gson (Maven) Fixed in 2.8.9 Advisory →
Red Hat 12 advisories
- RHSA-2025:4437 Released 2025-05-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.13 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
- RHSA-2025:4226 Released 2025-04-28 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
- RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
Show 9 more Red Hat advisories
- RHSA-2022:6835 Released 2022-10-06 · Red Hat rating ImportantService Registry (container images) release and security update [2.3.0.GA]
- RHINT Service Registry 2.3.0 GA
- RHSA-2022:6819 Released 2022-10-05 · Red Hat rating ImportantRed Hat AMQ Streams 2.2.0 release and security update
- Red Hat AMQ Streams 2.2.0
- RHSA-2022:5928 Released 2022-08-08 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss Enterprise Application Platform com.google.code.gson.gson-2.8.9.redhat-00001.jar, io.netty.netty-codec-http-4.1.77.Final-redhat-00001.jar, org.jboss.hal.hal-console-3.3.13.Final-redhat-00001-resources.jar
- RHSA-2022:5903 Released 2022-08-04 · Red Hat rating ModerateRed Hat Process Automation Manager 7.13.0 security update
- RHPAM 7.13.0 async
- RHSA-2022:5894 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update.
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-1-18.el9eap, eap7-FastInfoset-1.2.13-11.1.redhat_1.1.el9eap, eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el9eap +47
- RHSA-2022:5892 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-gson-2.8.9-1.redhat_00001.1.el7eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el7eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el7eap +27
- RHSA-2022:5893 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-gson-2.8.9-1.redhat_00001.1.el8eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el8eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el8eap +27
- RHSA-2022:5029 Released 2022-06-23 · Red Hat rating ModerateRed Hat build of Eclipse Vert.x 4.2.7 security update
- Red Hat build of Eclipse Vert.x 4.2.7
- RHSA-2022:4985 Released 2022-06-09 · Red Hat rating ModerateCryostat 2.1.1: new Cryostat on RHEL 8 container images
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8, cryostat-tech-preview/cryostat-rhel8 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat build of Quarkus | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2022:4985 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2023:3299 |
| RHINT Service Registry 2.3.0 GA | Fixed | RHSA-2022:6835 |
| RHPAM 7.13.0 async | Fixed | RHSA-2022:5903 |
| Red Hat AMQ Streams 2.2.0 | Fixed | RHSA-2022:6819 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2022:5892 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2022:5893 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2022:5894 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2022:5928 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:4226 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:4437 |
| Red Hat build of Eclipse Vert.x 4.2.7 | Fixed | RHSA-2022:5029 |
Not affected: 10 products
- A-MQ Clients 2
- OpenShift Developer Tools and Services for OCP 4.13
- Red Hat A-MQ Online
- Red Hat AMQ Broker 7
- Red Hat Data Grid 8
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Debezium 1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25647
- 2026-10-03 Alias added: GHSA-4jrv-ppp4-jm57
References
Patch 3
Advisory 5
Sources
- CVE-2022-25647 · CVE Program
- CVE-2022-25647 · NVD
- FIRST EPSS
- GHSA-4jrv-ppp4-jm57 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-25647 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences