GHSA-2gh6-wc3m-g37f

hermes-management is vulnerable to RCE due to Apache commons-jxpath

9.3 CriticalFix available

Impact

hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

Patches

Upgrade Hermes to at least hermes-2.2.9

References

https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

GitHub Advisories Score used9.3

hermes-management is vulnerable to RCE due to Apache commons-jxpath

Impact

hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

Patches

Upgrade Hermes to at least hermes-2.2.9

References

https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

Record: GHSA-2gh6-wc3m-g37f
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1395
Updated: 2026-11-02

OSV9.3

hermes-management is vulnerable to RCE due to Apache commons-jxpath

Impact

hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

Patches

Upgrade Hermes to at least hermes-2.2.9

References

https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

Record: GHSA-2gh6-wc3m-g37f
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1395
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`pl.allegro.tech.hermes:hermes-management` Maven	0.8.2 up to 2.2.9	2.2.9
`pl.allegro.tech.hermes:hermes-management` Maven	0.8.2 up to 2.2.9, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less 0.10.50.10.60.11.00.11.10.11.20.11.30.11.40.12.00.12.10.12.100.12.20.12.30.12.40.12.50.12.60.12.70.12.80.12.90.13.00.13.10.13.20.13.30.13.40.13.50.14.00.15.00.15.10.15.10-enable-setting-idle-connection-timeout-for-jetty-client0.15.20.15.30.15.40.15.50.15.60.15.70.15.80.15.90.16.00.16.10.16.20.8.100.8.10-hotfix10.8.10-hotfix20.8.110.8.120.8.3	2.2.9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-2gh6-wc3m-g37f is a critical vulnerability (CVSS 9.3) in pl.allegro.tech.hermes:hermes-management, published September 17, 2024. No source lists public exploit code. Fixed in pl.allegro.tech.hermes:hermes-management 2.2.9.

References

This page doesn't list everything

Left out here: 124 versions. The JSON record has them.