{"id":"CVE-2015-3253","aliases":["DEBIAN-CVE-2015-3253","DLA-274-1","EUVD-2022-4964","GHSA-qg25-hgjv-cg9q","MGASA-2015-0296","MGASA-2017-0333","RHSA-2017:2486","RHSA-2017:2596","UBUNTU-CVE-2015-3253"],"status":"published","title":"Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.41032,"percentile":0.9867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2015-07-18T00:00:00Z","modified":"2026-09-09T07:01:17Z","fixes":[{"ecosystem":"Maven","package":"org.codehaus.groovy:groovy","fixed_in":["2.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","fixed_in":["2.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"groovy","fixed_in":["2.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"groovy","fixed_in":["2.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"groovy","fixed_in":["2.4.6-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"groovy","fixed_in":["1.7.0-4+deb6u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"groovy","fixed_in":["1.8.7-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"groovy","fixed_in":["1.8.9-5.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"groovy18","fixed_in":["1.8.9-26.2.mga6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"last_affected":"2.4.3"},{"fixed":"2.4.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"last_affected":"2.4.3"},{"fixed":"2.4.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4+deb6u1"}]}],"versions":["1.7.0-4"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"2.4.4"}]}],"versions":["1.7.0","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.0-beta-1","1.8.0-beta-2","1.8.0-beta-3","1.8.0-beta-4","1.8.0-rc-1","1.8.0-rc-2","1.8.0-rc-3","1.8.0-rc-4","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9.0-beta-1","1.9.0-beta-2","1.9.0-beta-3","1.9.0-beta-4","2.0.0","2.0.0-beta-1","2.0.0-beta-2","2.0.0-beta-3","2.0.0-rc-1","2.0.0-rc-2","2.0.0-rc-3","2.0.0-rc-4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.2","2.4.3"]},{"source":"osv","ecosystem":"Maven","package":"org.codehaus.groovy:groovy-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"2.4.4"}]}],"versions":["1.7.0","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0","1.8.0-beta-1","1.8.0-beta-2","1.8.0-beta-3","1.8.0-beta-4","1.8.0-rc-1","1.8.0-rc-2","1.8.0-rc-3","1.8.0-rc-4","1.8.1","1.8.2","1.8.2-jenkins-1","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.9.0-beta-1","1.9.0-beta-2","1.9.0-beta-3","1.9.0-beta-4","2.0.0","2.0.0-beta-1","2.0.0-beta-2","2.0.0-beta-3","2.0.0-rc-1","2.0.0-rc-2","2.0.0-rc-3","2.0.0-rc-4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.1.0","2.1.0-beta-1","2.1.0-rc-1","2.1.0-rc-2","2.1.0-rc-3","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-beta-1","2.2.0-beta-2","2.2.0-rc-1","2.2.0-rc-2","2.2.0-rc-3","2.2.1","2.2.2","2.3.0","2.3.0-beta-1","2.3.0-beta-2","2.3.0-rc-1","2.3.0-rc-2","2.3.0-rc-4","2.3.1","2.3.10","2.3.11","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-beta-1","2.4.0-beta-2","2.4.0-beta-3","2.4.0-beta-4","2.4.0-rc-1","2.4.0-rc-2","2.4.1","2.4.2","2.4.3"]},{"source":"osv","ecosystem":"Mageia:4","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9-5.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"groovy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9-26.2.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-8.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-maven33-groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-7.19.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-maven33-groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-7.19.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-maven33-groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-7.19.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-maven33-groovy-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.9-7.19.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"groovy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~beta2+isreally1.8.6-4ubuntu1"]}],"products":[{"vendor":"apache","product":"groovy"},{"vendor":"oracle","product":"health_sciences_clinical_development_center"},{"vendor":"oracle","product":"retail_order_broker_cloud_service"},{"vendor":"oracle","product":"retail_service_backbone"},{"vendor":"oracle","product":"retail_store_inventory_management"},{"vendor":"oracle","product":"webcenter_sites"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2596","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1376","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201610-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://groovy-lang.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20160623-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0066.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"http://www.securityfocus.com/bid/91787","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-15-365/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2486","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1034815","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/75919","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/archive/1/536012/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3253","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed@%3Cnotifications.shardingsphere.apache.org%3E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20160623-0001","tags":["web"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-15-365","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qg25-hgjv-cg9q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3253","tags":["advisory"]},{"url":"https://github.com/apache/groovy","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0296.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16393","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2017-0333.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21649","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/I2E3KU5UUQCI7TN3MCB6I6JI2EE7GR77/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1413466","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2486.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1243934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3253","tags":["advisory","report"]},{"url":"http://seclists.org/oss-sec/2015/q3/121","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6814","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6814","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2596.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3253","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3253","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:00:00Z","modified":"2024-08-06T05:39:32.116Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2022-4964","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-qg25-hgjv-cg9q","title":"Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2022-05-13T01:25:41Z","modified":"2024-10-17T16:17:25Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2015-3253","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:59:02.377Z","modified":"2026-06-17T00:25:37.46Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-3253","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:59:02Z","modified":"2026-04-16T06:26:05.376050376Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3253","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:59:02.377Z","modified":"2026-09-09T07:01:17.460479734Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-qg25-hgjv-cg9q","title":"Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2022-05-13T01:25:41Z","modified":"2024-10-17T16:23:29.12379Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"RHSA-2017:2486","title":"Red Hat Security Advisory: groovy security update","status":"published","published":"2024-09-13T14:41:46Z","modified":"2026-08-05T10:04:40Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2596","title":"Red Hat Security Advisory: rh-maven33-groovy security update","status":"published","published":"2024-09-13T14:41:22Z","modified":"2026-08-05T10:04:41Z","cvss":[{"version":"3.0","score":9.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2015-3253","description":"The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.","status":"published","published":"2015-08-13T14:59:00Z","modified":"2025-10-24T04:45:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"DLA-274-1","title":"groovy - security update","status":"published","published":"2015-07-18T00:00:00Z","modified":"2026-03-09T01:20:07.661298Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2015-0296","title":"Updated groovy package fixes security vulnerability","description":"When an application has Groovy on the classpath and that it uses standard\nJava serialization mechanim to communicate between servers, or to store\nlocal data, it is possible for an attacker to bake a special serialized\nobject that will execute code directly when deserialized. All applications\nwhich rely on serialization and do not isolate the code which deserializes\nobjects are subject to this vulnerability (CVE-2015-3253).\n","status":"published","published":"2015-07-30T21:08:51Z","modified":"2026-04-16T06:24:16.095695734Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2017-0333","title":"Updated groovy18 packages fix security vulnerability","description":"When an application has Groovy on the classpath and that it uses\nstandard Java serialization mechanism to communicate between servers, or\nto store local data, it is possible for an attacker to bake a special\nserialized object that will execute code directly when deserialized. All\napplications which rely on serialization and do not isolate the code\nwhich deserializes objects are subject to this vulnerability\n(CVE-2015-3253).\n","status":"published","published":"2017-09-07T09:07:16Z","modified":"2026-04-16T06:24:46.61699367Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}