Read the docs
TI-2022-22144 Aliases CVE-2022-45047GHSA-fhw8-8j55-vwgq

Apache MINA SSHD: Java unsafe deserialization vulnerability

Priority HIGH 82CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 23 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0381 90th percentileScored 2026-11-07
Fix Partial org.apache.sshd:sshd-common (Maven): 2.9.2org.apache.sshd:sshd-core (Maven): 2.9.2Red Hat: 21 advisoriesRed Hat: 23 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA SSHDup to 2.9.1—No fix listedCNA
—org.apache.sshd:sshd-common (Maven)before 2.9.22.9.2Patch availableGHSA-fhw8-8j55-vwgq
—org.apache.sshd:sshd-core (Maven)before 2.9.22.9.2Patch availableGHSA-fhw8-8j55-vwgq
  • Apache MINA SSHD VendorApache Affected up to 2.9.1 Fixed in — No fix listed CNA
  • org.apache.sshd:sshd-common (Maven) Vendor— Affected before 2.9.2 Fixed in 2.9.2 Patch available GHSA-fhw8-8j55-vwgq
  • org.apache.sshd:sshd-core (Maven) Vendor— Affected before 2.9.2 Fixed in 2.9.2 Patch available GHSA-fhw8-8j55-vwgq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:*up to 2.9.1VulnerableApache
  • cpe:2.3:a:apache:sshd:*:*:*:*:*:*:*:* Versions up to 2.9.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-fhw8-8j55-vwgq org.apache.sshd:sshd-common (Maven) Fixed in 2.9.2 Advisory →
  • Fix · GHSA-fhw8-8j55-vwgq org.apache.sshd:sshd-core (Maven) Fixed in 2.9.2 Advisory →

Red Hat 21 advisories

  • RHSA-2025:1747 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.12 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
  • RHSA-2025:1746 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
  • RHSA-2023:4983 Released 2023-09-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.4 security update
    • RHPAM 7.13.4 async
Show 18 more Red Hat advisories
  • RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
    • RHINT Camel-Springboot 3.18.3.P2
  • RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Critical
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
  • RHSA-2023:1064 Released 2023-03-06 · Red Hat rating Critical
    OpenShift Developer Tools and Services for OCP 4.12 security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1675702407-1.el8
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0777 Released 2023-02-23 · Red Hat rating Critical
    OpenShift Container Platform 4.9.56 security update
    • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1675668922-1.el8, jenkins-2.361.1.1675668150-1.el8
  • RHSA-2023:0758 Released 2023-02-14 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.7 release and security update
    • Red Hat build of Quarkus
  • RHSA-2023:0713 Released 2023-02-09 · Red Hat rating Important
    Red Hat Data Grid 8.4.1 security update
    • Red Hat Data Grid 8.4.1
  • RHSA-2023:0560 Released 2023-02-08 · Red Hat rating Critical
    OpenShift Container Platform 4.10.51 security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1675144701-1.el8
  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2023:0074 Released 2023-01-11 · Red Hat rating Important
    RHV 4.4 SP1 [ovirt-4.5.3-3] security update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-sshd-1:2.9.2-0.1.el8ev, apache-sshd-javadoc-1:2.9.2-0.1.el8ev, ovirt-engine-ui-extensions-1.3.7-1.el8ev
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 vdsm-4.50.3.6-1.el8ev, vdsm-hook-checkips-4.50.3.6-1.el8ev, vdsm-hook-cpuflags-4.50.3.6-1.el8ev +7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts vdsm-4.50.3.6-1.el8ev, vdsm-api-4.50.3.6-1.el8ev, vdsm-client-4.50.3.6-1.el8ev +16
  • RHSA-2022:8957 Released 2022-12-13 · Red Hat rating Important
    Red Hat build of Quarkus Platform 2.7.6.SP3 and security update
    • Red Hat build of Quarkus Platform 2.7.6.SP3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 6AffectedNo fix yet
Migration Toolkit for RuntimesAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2023:1047
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3198
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:1064
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2023:0074
RHINT Camel-Springboot 3.18.3.P2Fixed RHSA-2023:3641
RHPAM 7.13.4 asyncFixed RHSA-2023:4983
Red Hat Data Grid 8.4.1Fixed RHSA-2023:0713
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:1747
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:0560
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2023:0777
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2023:0074
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2023:0074
Red Hat build of QuarkusFixed RHSA-2023:0758
Red Hat build of Quarkus Platform 2.7.6.SP3Fixed RHSA-2022:8957
Not affected: 14 products
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat AMQ Broker 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat build of Apache Camel for Spring Boot 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45047
  2. 2026-10-03 Alias added: GHSA-fhw8-8j55-vwgq
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-24 EPSS moved to the 90th–95th percentile
  5. 2026-10-25 EPSS moved to the 50th–90th percentile
  6. 2026-10-29 EPSS moved to the 90th–95th percentile

References

Advisory 1

Other 7

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2021-10677 DoS/OOM leak vulnerability in Apache Mina SSHD Server CVSS 3.1MEDIUM 6.5
  • TI-2023-17957 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences