CVE-2022-24329
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
CVE-2022-24329- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-829
- Updated
- 2026-11-02
CVE List No score
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
CVE-2022-24329- Updated
- 2026-11-02
EUVDEUVD-2022-0768 No score
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
EUVD-2022-0768- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2qp4-g3q3-f92w
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
GHSA-2qp4-g3q3-f92w- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-667, CWE-829
- Updated
- 2026-11-02
OSVGHSA-2qp4-g3q3-f92w
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
GHSA-2qp4-g3q3-f92w- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-667, CWE-829
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-24329
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
UBUNTU-CVE-2022-24329- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV No score
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
- Record
CVE-2022-24329- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jetbrains.kotlin:kotlin-stdlibMaven |
through 1.5.32 | 1.6.0 |
org.jetbrains.kotlin:kotlin-stdlibMaven |
before 1.6.0, plus listed versions 0.0.1-test-deploy0.0.2-test-deploy0.10.13160.10.1950.10.4 Show 45 moreShow less0.10.7090.10.7700.11.910.11.91.10.11.91.20.11.91.40.12.12180.12.12300.12.2000.12.2130.12.4120.12.6130.13.15130.13.15140.13.15160.14.4490.14.4510.5.11310.5.9980.6.10700.6.13150.6.14110.6.15070.6.15900.6.16030.6.16170.6.16580.6.16700.6.16730.6.1790.6.19100.6.220.6.24510.6.25170.6.310.6.3170.6.3500.6.5940.6.6020.6.690.6.7860.6.8000.6.9120.7.10900.7.115 |
1.6.0 |
kotlinUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.31+~1.0.1+~0.11.12-2 |
None known |
kotlinUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.31+ds1-1build51.3.31+ds1-1ubuntu1 |
None known |
kotlinUbuntu:25.10 |
All versions, plus listed versions 1.3.31+ds1-21.3.31+ds1-3 |
None known |
kotlinUbuntu:26.10 |
All versions, plus listed versions 1.3.31+ds1-3ubuntu11.3.31+ds1-4 |
None known |
kotlinUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.31+ds1-31.3.31+ds1-3ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24329 is a medium vulnerability (CVSS 5.3) in Jetbrains Kotlin, published February 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in org.jetbrains.kotlin:kotlin-stdlib 1.6.0.
References
Left out here: 122 versions. The JSON record has them.