Read the docs
TI-2022-17226 Aliases CVE-2022-37022GHSA-qf8g-vpwp-6579

Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11

Priority MEDIUM 41CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.

Why it matters now

EPSS 0.01509 74th percentileScored 2026-11-07
Fix Fixed org.apache.geode:geode-core (Maven): 1.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache GeodeApache Geode – 1.12.2—No fix listedCNA
—org.apache.geode:geode-core (Maven)before 1.15.01.15.0Patch availableGHSA-qf8g-vpwp-6579
  • Apache Geode VendorApache Affected Apache Geode – 1.12.2 Fixed in — No fix listed CNA
  • org.apache.geode:geode-core (Maven) Vendor— Affected before 1.15.0 Fixed in 1.15.0 Patch available GHSA-qf8g-vpwp-6579

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:*up to 1.12.2; 1.13.0 – 1.13.2VulnerableApache
  • cpe:2.3:a:apache:geode:*:*:*:*:*:*:*:* Versions up to 1.12.2; 1.13.0 – 1.13.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-qf8g-vpwp-6579 org.apache.geode:geode-core (Maven) Fixed in 1.15.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-37022
  2. 2026-10-03 Alias added: GHSA-qf8g-vpwp-6579

References

Advisory 2

  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
  • TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
  • TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences