Read the docs
TI-2022-20205 Aliases CVE-2022-41853GHSA-77xx-rxvh-q682

Remote code execution in HyperSQL DataBase

Priority MEDIUM 51CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05145 92nd percentileScored 2026-11-07
Fix Partial hsqldb (HyperSQL DataBase): 2.7.1org.hsqldb:hsqldb (Maven): 2.7.1Red Hat: 10 advisoriesRed Hat: 16 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HyperSQL DataBasehsqldbbefore 2.7.12.7.1Patch availableCNA
—org.hsqldb:hsqldb (Maven)before 2.7.12.7.1Patch availableGHSA-77xx-rxvh-q682
  • hsqldb VendorHyperSQL DataBase Affected before 2.7.1 Fixed in 2.7.1 Patch available CNA
  • org.hsqldb:hsqldb (Maven) Vendor— Affected before 2.7.1 Fixed in 2.7.1 Patch available GHSA-77xx-rxvh-q682

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:hsqldb:hypersql_database:*:*:*:*:*:*:*:*before 2.7.1VulnerableHsqldb
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:hsqldb:hypersql_database:*:*:*:*:*:*:*:* Versions before 2.7.1 Vulnerable ·Hsqldb
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA hsqldb (HyperSQL DataBase) Fixed in 2.7.1
  • Fix · GHSA-77xx-rxvh-q682 org.hsqldb:hsqldb (Maven) Fixed in 2.7.1 Advisory →

Red Hat 10 advisories

  • RHSA-2024:10207 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.11 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
  • RHSA-2024:10208 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services-3.1.16-3.SP1_redhat_00001.1.ep7.el7 +14
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
Show 7 more Red Hat advisories
  • RHSA-2023:1516 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 security update
    • Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
  • RHSA-2023:1512 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
  • RHSA-2023:1513 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
  • RHSA-2023:1514 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1
  • RHSA-2022:8560 Released 2022-11-21 · Red Hat rating Important
    hsqldb security update
    • Red Hat Enterprise Linux Client Optional (v. 7) hsqldb-1:1.8.1.3-15.el7_9, hsqldb-demo-1:1.8.1.3-15.el7_9, hsqldb-javadoc-1:1.8.1.3-15.el7_9 +1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) hsqldb-1:1.8.1.3-15.el7_9, hsqldb-demo-1:1.8.1.3-15.el7_9, hsqldb-javadoc-1:1.8.1.3-15.el7_9 +1
    • Red Hat Enterprise Linux Server (v. 7) hsqldb-1:1.8.1.3-15.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) hsqldb-1:1.8.1.3-15.el7_9, hsqldb-demo-1:1.8.1.3-15.el7_9, hsqldb-javadoc-1:1.8.1.3-15.el7_9 +1
    • Red Hat Enterprise Linux Workstation (v. 7) hsqldb-1:1.8.1.3-15.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) hsqldb-demo-1:1.8.1.3-15.el7_9, hsqldb-javadoc-1:1.8.1.3-15.el7_9, hsqldb-manual-1:1.8.1.3-15.el7_9
  • RHSA-2022:8559 Released 2022-11-21 · Red Hat rating Important
    hsqldb security update
    • Red Hat Enterprise Linux Server (v. 6 ELS) hsqldb-1:1.8.0.10-13.el6_10
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) hsqldb-1:1.8.0.10-13.el6_10, hsqldb-demo-1:1.8.0.10-13.el6_10, hsqldb-javadoc-1:1.8.0.10-13.el6_10 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet: Fix deferred
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2022:8560
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2022:8560
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2022:8559
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:8560
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2022:8559
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:8560
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:8560
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2022:8560
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:1512
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:1513
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:1514
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:1516
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2024:10207
Not affected: 8 products
  • A-MQ Clients 2
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41853
  2. 2026-10-03 Alias added: GHSA-77xx-rxvh-q682
  3. 2026-10-04 EPSS moved to the 90th–95th percentile

References

Advisory 5

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences