CVE-2015-3253
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
CVE-2015-3253- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
CVE-2015-3253- Updated
- 2026-11-02
EUVDEUVD-2022-4964 No score
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
EUVD-2022-4964- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qg25-hgjv-cg9q
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
GHSA-qg25-hgjv-cg9q- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
CVE-2015-3253- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3253
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
DEBIAN-CVE-2015-3253- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-qg25-hgjv-cg9q
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
GHSA-qg25-hgjv-cg9q- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVRHSA-2017:2486
Red Hat Security Advisory: groovy security update
- Record
RHSA-2017:2486- CVSS 3.0
- 9.6 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2017:2596
Red Hat Security Advisory: rh-maven33-groovy security update
- Record
RHSA-2017:2596- CVSS 3.0
- 9.6 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3253
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
- Record
UBUNTU-CVE-2015-3253- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2015-0296 No score
Updated groovy package fixes security vulnerability
When an application has Groovy on the classpath and that it uses standard Java serialization mechanim to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability (CVE-2015-3253).
- Record
MGASA-2015-0296- Updated
- 2026-11-02
OSVMGASA-2017-0333 No score
Updated groovy18 packages fix security vulnerability
When an application has Groovy on the classpath and that it uses standard Java serialization mechanism to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability (CVE-2015-3253).
- Record
MGASA-2017-0333- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.codehaus.groovy:groovyMaven |
1.7.0 to 2.4.3 | 2.4.4 |
org.codehaus.groovy:groovy-allMaven |
1.7.0 to 2.4.3 | 2.4.4 |
groovyDebian:12 |
before 2.4.6-1 | 2.4.6-1 |
groovyDebian:13 |
before 2.4.6-1 | 2.4.6-1 |
groovyDebian:14 |
before 2.4.6-1 | 2.4.6-1 |
groovyDebian:6.0 |
before 1.7.0-4+deb6u1, plus listed versions 1.7.0-4 |
1.7.0-4+deb6u1 |
org.codehaus.groovy:groovyMaven |
1.7.0 up to 2.4.4, plus listed versions 1.7.11.7.101.7.111.7.21.7.3 Show 45 moreShow less1.7.41.7.51.7.61.7.71.7.81.7.91.8.01.8.0-beta-11.8.0-beta-21.8.0-beta-31.8.0-beta-41.8.0-rc-11.8.0-rc-21.8.0-rc-31.8.0-rc-41.8.11.8.21.8.31.8.41.8.51.8.61.8.71.8.81.8.91.9.0-beta-11.9.0-beta-21.9.0-beta-31.9.0-beta-42.0.02.0.0-beta-12.0.0-beta-22.0.0-beta-32.0.0-rc-12.0.0-rc-22.0.0-rc-32.0.0-rc-42.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.1.0 |
2.4.4 |
org.codehaus.groovy:groovy-allMaven |
1.7.0 up to 2.4.4, plus listed versions 1.7.11.7.101.7.111.7.21.7.3 Show 45 moreShow less1.7.41.7.51.7.61.7.71.7.81.7.91.8.01.8.0-beta-11.8.0-beta-21.8.0-beta-31.8.0-beta-41.8.0-rc-11.8.0-rc-21.8.0-rc-31.8.0-rc-41.8.11.8.21.8.2-jenkins-11.8.31.8.41.8.51.8.61.8.71.8.81.8.91.9.0-beta-11.9.0-beta-21.9.0-beta-31.9.0-beta-42.0.02.0.0-beta-12.0.0-beta-22.0.0-beta-32.0.0-rc-12.0.0-rc-22.0.0-rc-32.0.0-rc-42.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.8 |
2.4.4 |
groovyMageia:4 |
before 1.8.7-3.1.mga4 | 1.8.7-3.1.mga4 |
groovyMageia:5 |
before 1.8.9-5.1.mga5 | 1.8.9-5.1.mga5 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
groovy18Mageia:6 |
before 1.8.9-26.2.mga6 | 1.8.9-26.2.mga6 |
groovyRed Hat:enterprise_linux:7::client |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovy-javadocRed Hat:enterprise_linux:7::client |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovyRed Hat:enterprise_linux:7::computenode |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovy-javadocRed Hat:enterprise_linux:7::computenode |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovyRed Hat:enterprise_linux:7::server |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovy-javadocRed Hat:enterprise_linux:7::server |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovyRed Hat:enterprise_linux:7::workstation |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
groovy-javadocRed Hat:enterprise_linux:7::workstation |
before 0:1.8.9-8.el7_4 | 0:1.8.9-8.el7_4 |
rh-maven33-groovyRed Hat:rhel_software_collections:2::el6 |
before 0:1.8.9-7.19.el6 | 0:1.8.9-7.19.el6 |
rh-maven33-groovy-javadocRed Hat:rhel_software_collections:2::el6 |
before 0:1.8.9-7.19.el6 | 0:1.8.9-7.19.el6 |
rh-maven33-groovyRed Hat:rhel_software_collections:2::el7 |
before 0:1.8.9-7.19.el7 | 0:1.8.9-7.19.el7 |
rh-maven33-groovy-javadocRed Hat:rhel_software_collections:2::el7 |
before 0:1.8.9-7.19.el7 | 0:1.8.9-7.19.el7 |
groovyUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.0~beta2+isreally1.8.6-4ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3253 is a critical vulnerability (CVSS 9.8) in Apache Groovy, published July 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 41.0%, the 98th percentile. Fixed in org.codehaus.groovy:groovy 2.4.4.
References
oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
access.redhat.com/errata/RHSA-2017:2596
security.gentoo.org/glsa/201610-01
groovy-lang.org/security.html
Show 39 moreShow less
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html
security.netapp.com/advisory/ntap-20160623-0001
rhn.redhat.com/errata/RHSA-2016-0066.html
securityfocus.com/bid/91787
zerodayinitiative.com/advisories/ZDI-15-365
securitytracker.com/id/1034815
lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-3253
github.com/advisories/GHSA-qg25-hgjv-cg9q
security-tracker.debian.org/tracker/CVE-2015-3253
advisories.mageia.org/MGASA-2015-0296.html
bugs.mageia.org/show_bug.cgi?id=16393
lists.fedoraproject.org/archives/list/[email protected]/thread/I2E3KU5UUQCI7TN3MCB6I6JI2EE7GR77
bugzilla.redhat.com/show_bug.cgi?id=1413466
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2486.json
cve.org/CVERecord?id=CVE-2015-3253
seclists.org/oss-sec/2015/q3/121
ubuntu.com/security/CVE-2015-3253
Left out here: 97 versions. The JSON record has them.