CVE-2017-3199

GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

8.1 High

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.04%Up 3.8 points since Apr 14, 2021

What each source reports

NVD Score used 8.1

Record: CVE-2017-3199
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization

Record: CVE-2017-3199
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2022-3199 No score

Record: EUVD-2022-3199
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8m35-r25c-qr56 8.1

GraniteDS Insecure Deserialization

Record: GHSA-8m35-r25c-qr56
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVGHSA-8m35-r25c-qr56 8.1

GraniteDS Insecure Deserialization

Record: GHSA-8m35-r25c-qr56
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.graniteds:granite-core` Maven	through 3.1.1.GA	None known
`org.graniteds:granite-core` Maven	through 3.1.1.GA, plus listed versions 1.1.0.GA1.2.01.2.0.RC11.2.0_SP12.0.0.B1 Show 18 moreShow less 2.0.0.B22.0.0.GA2.0.0.RC12.0.0.SP12.1.0.GA2.1.0.RC22.2.0.GA2.2.0.RC22.2.0.SP12.2.0.SP22.2.1.GA2.3.0.GA2.3.0.RC12.3.1.GA2.3.2.GA3.0.0.M13.0.0.M23.0.0.M3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-3199 is a high vulnerability (CVSS 8.1) in Graniteds, published June 11, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.04%, the 93rd percentile. No source names a fixed version.