CVE-2022-36437
Hazelcast connection caching
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
- Record
CVE-2022-36437- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
- Record
CVE-2022-36437- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2022-7594
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
- Record
EUVD-2022-7594- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c5hg-mr8r-f6jp
Hazelcast connection caching
Impact
The Connection handler in Hazelcast and Hazelcast Jet allows an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. The affected Hazelcast versions are through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Patches
Hazelcast Jet (and Enterprise) 4.5.4. Hazelcast IMDG (and Enterprise)3.12.13 Hazelcast IMDG (and Enterprise) 4.1.10 Hazelcast IMDG (and Enterprise) 4.2.6 Hazelcast Platform (and Enterprise) 5.1.3
Workarounds
There is no known workaround, but setups with TLS and mutual authentication enabled significantly lowers the exploitation risk.
References
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437
- Record
GHSA-c5hg-mr8r-f6jp- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
- Record
CVE-2022-36437- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-c5hg-mr8r-f6jp
Hazelcast connection caching
Impact
The Connection handler in Hazelcast and Hazelcast Jet allows an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. The affected Hazelcast versions are through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
Patches
Hazelcast Jet (and Enterprise) 4.5.4. Hazelcast IMDG (and Enterprise)3.12.13 Hazelcast IMDG (and Enterprise) 4.1.10 Hazelcast IMDG (and Enterprise) 4.2.6 Hazelcast Platform (and Enterprise) 5.1.3
Workarounds
There is no known workaround, but setups with TLS and mutual authentication enabled significantly lowers the exploitation risk.
References
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437
- Record
GHSA-c5hg-mr8r-f6jp- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.hazelcast:hazelcastMaven |
through 3.12.12 | 3.12.13 |
com.hazelcast:hazelcastMaven |
4.0 to 4.0.6 | None known |
com.hazelcast:hazelcastMaven |
4.1 to 4.1.9 | 4.1.10 |
com.hazelcast:hazelcastMaven |
4.2 to 4.2.5 | 4.2.6 |
com.hazelcast:hazelcastMaven |
5.0 to 5.0.3 | 5.0.4 |
com.hazelcast:hazelcastMaven |
5.1 to 5.1.2 | 5.1.3 |
com.hazelcast.jet:hazelcast-jetMaven |
through 4.5.3 | 4.5.4 |
com.hazelcast.jet:hazelcast-jet-enterpriseMaven |
through 4.5.3 | 4.5.4 |
com.hazelcast:hazelcast-enterpriseMaven |
through 3.12.12 | 3.12.13 |
com.hazelcast:hazelcast-enterpriseMaven |
4.0 to 4.0.6 | None known |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.hazelcast:hazelcast-enterpriseMaven |
4.1 to 4.1.9 | 4.1.10 |
com.hazelcast:hazelcast-enterpriseMaven |
4.2 to 4.2.5 | 4.2.6 |
com.hazelcast:hazelcast-enterpriseMaven |
5.0 to 5.0.3 | 5.0.4 |
com.hazelcast:hazelcast-enterpriseMaven |
5.1 to 5.1.2 | 5.1.3 |
com.hazelcast:hazelcastMaven |
before 3.12.13, plus listed versions 1.51.5.11.5.21.5.31.6 Show 45 moreShow less1.6-RC11.71.7-RC11.7-RC21.7-RC31.7-RC41.7.11.81.8.11.8.21.8.31.8.41.8.51.91.9.11.9.1-RC21.9.21.9.2.11.9.2.21.9.2.31.9.31.9.3-RC1.9.3.11.9.3.21.9.3.31.9.3.41.9.41.9.4-RC1.9.4-RC11.9.4.11.9.4.21.9.4.31.9.4.41.9.4.51.9.4.61.9.4.82.02.0-RC12.0-RC22.0.12.0.22.0.32.0.42.12.1.1 |
3.12.13 |
com.hazelcast:hazelcastMaven |
4.0 to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
None known |
com.hazelcast:hazelcastMaven |
4.1 up to 4.1.10, plus listed versions 4.1.14.1.24.1.34.1.44.1.5 Show 4 moreShow less4.1.64.1.74.1.84.1.9 |
4.1.10 |
com.hazelcast:hazelcastMaven |
4.2 up to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.44.2.5 |
4.2.6 |
com.hazelcast:hazelcastMaven |
5.0 up to 5.0.4, plus listed versions 5.0.15.0.25.0.3 |
5.0.4 |
com.hazelcast:hazelcastMaven |
5.1 up to 5.1.3, plus listed versions 5.1.15.1.2 |
5.1.3 |
com.hazelcast.jet:hazelcast-jetMaven |
before 4.5.4, plus listed versions 0.30.3.10.40.50.5.1 Show 21 moreShow less0.60.6.10.70.7.10.7.23.03.13.23.2.13.2.24.04.14.1.14.24.34.3.14.44.54.5.14.5.24.5.3 |
4.5.4 |
com.hazelcast.jet:hazelcast-jet-enterpriseMaven |
before 4.5.4 | 4.5.4 |
com.hazelcast:hazelcast-enterpriseMaven |
before 3.12.13 | 3.12.13 |
com.hazelcast:hazelcast-enterpriseMaven |
4.1 up to 4.1.10 | 4.1.10 |
com.hazelcast:hazelcast-enterpriseMaven |
4.2 up to 4.2.6 | 4.2.6 |
com.hazelcast:hazelcast-enterpriseMaven |
5.0 up to 5.0.4 | 5.0.4 |
com.hazelcast:hazelcast-enterpriseMaven |
5.1 up to 5.1.3 | 5.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36437 is a critical vulnerability (CVSS 9.1) in Hazelcast, published December 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in com.hazelcast:hazelcast 3.12.13.
References
github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp
support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437
nvd.nist.gov/vuln/detail/CVE-2022-36437
Left out here: 149 versions. The JSON record has them.