Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact If you are using the **Apiman Vert.x Gateway** prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. Hazelcast is a transitive dependency of the Apiman Vert.x Gateway. The precise risk is difficult to quantify at this juncture as plugins deployed by users may make use of Hazelcast in a different manner to the main Apiman codebase. If any of your custom Apiman plugins specify Hazelcast dependencies, you should also bump these versions. Hint: an easy way to track Apiman dependency versions is to use `apiman-parent`. If you use the Apiman Tomcat or WildFly Gateway this does not affect you. ### Patches Upgrade to **Apiman 3.0.0.Final or later**. If you are using an older version of Apiman and need to remain on that version, contact to your Apiman support provider for advice/long-term support. ### Workarounds None (other than doing your own build). ### References * https://github.com/advisories/GHSA-c5hg-mr8r-f6jp
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | io.apiman:apiman-gateway-platforms-vertx (Maven) | before 3.0.0.Final | 3.0.0.Final | Patch available | GHSA-q2fj-6h62-59m2 |
| — | io.apiman:apiman-distro-vertx (Maven) | before 3.0.0.Final | 3.0.0.Final | Patch available | GHSA-q2fj-6h62-59m2 |
- io.apiman:apiman-gateway-platforms-vertx (Maven) Vendor— Affected before 3.0.0.Final Fixed in 3.0.0.Final Patch available GHSA-q2fj-6h62-59m2
- io.apiman:apiman-distro-vertx (Maven) Vendor— Affected before 3.0.0.Final Fixed in 3.0.0.Final Patch available GHSA-q2fj-6h62-59m2
Remediation
- Fix · GHSA-q2fj-6h62-59m2 io.apiman:apiman-gateway-platforms-vertx (Maven) Fixed in 3.0.0.Final Advisory →
- Fix · GHSA-q2fj-6h62-59m2 io.apiman:apiman-distro-vertx (Maven) Fixed in 3.0.0.Final Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-q2fj-6h62-59m2
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences