Read the docs
TI-2024-35239 Aliases CVE-2024-52577GHSA-8355-xj3p-hv6q

Apache Ignite: Possible RCE when deserializing incoming messages by the server node

Priority MEDIUM 54CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03131 87th percentileScored 2026-11-07
Fix Fixed Apache Ignite (Apache Software Foundation): 2.17.0org.apache.ignite:ignite-core (Maven): 2.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ignite2.6.0 to before 2.17.02.17.0Patch availableCNA
—org.apache.ignite:ignite-core (Maven)2.6.0 to before 2.17.02.17.0Patch availableGHSA-8355-xj3p-hv6q
  • Apache Ignite VendorApache Affected 2.6.0 to before 2.17.0 Fixed in 2.17.0 Patch available CNA
  • org.apache.ignite:ignite-core (Maven) Vendor— Affected 2.6.0 to before 2.17.0 Fixed in 2.17.0 Patch available GHSA-8355-xj3p-hv6q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:*2.6.0 to before 2.17.0VulnerableApache
  • cpe:2.3:a:apache:ignite:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.17.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Ignite (Apache Software Foundation) Fixed in 2.17.0
  • Fix · GHSA-8355-xj3p-hv6q org.apache.ignite:ignite-core (Maven) Fixed in 2.17.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52577
  2. 2026-10-03 Alias added: GHSA-8355-xj3p-hv6q

References

Advisory 3

Other 2

  • TI-2018-01178 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05795 Deserialization of untrusted data in Apache Ignite CVSS 3.0CRITICAL 9.8
  • TI-2018-01199 Deserialization of untrusted data in Apache Ignite CVSS 3.0CRITICAL 9.8
  • TI-2020-01886 Missing authorization in Apache Ignite CVSS 3.1CRITICAL 9.1
  • TI-2025-31105 Apache Ignite: REST HTTP arbitrary file read vulnerability CVSS 4.0HIGH 8.5
  • TI-2017-05322 Information disclosure in Apache Ignite CVSS 3.0HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences