{"id":"CVE-2022-36944","aliases":["EUVD-2022-6746","GHSA-8qv5-68g4-248j","ROOT-APP-MAVEN-CVE-2022-36944","UBUNTU-CVE-2022-36944"],"status":"published","title":"Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.10968,"percentile":0.95922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2022-09-23T00:00:00Z","modified":"2026-10-28T02:30:43Z","exploits":[{"source":"pocgithub","id":"yarocher/lazylist-cve-poc","title":"yarocher/lazylist-cve-poc","date":"2023-05-16","url":"https://github.com/yarocher/lazylist-cve-poc"}],"fixes":[{"ecosystem":"Maven","package":"org.scala-lang:scala-library","fixed_in":["2.13.9"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.scala-lang:scala-library","fixed_in":["2.13.8-root.io.1","2.13.6-root.io.1","2.13.8-root.io.2","2.13.6-root.io.2","2.13.8-root.io.3","2.13.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.scala-lang:scala-library","fixed_in":["2.13.6-aikido.2","2.13.8-aikido.3","2.13.5-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.scala-lang:scala-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.scala-lang:scala-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.9"}]}],"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.scala-lang:scala-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-root.io.1"},{"fixed":"2.13.6-root.io.1"},{"fixed":"2.13.8-root.io.2"},{"fixed":"2.13.6-root.io.2"},{"fixed":"2.13.8-root.io.3"},{"fixed":"2.13.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.scala-lang:scala-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-aikido.2"},{"fixed":"2.13.8-aikido.3"},{"fixed":"2.13.5-aikido.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"scala-lang","product":"scala"},{"vendor":"scala-lang","product":"scala-collection-compat"}],"references":[{"url":"https://www.scala-lang.org/download/","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://github.com/scala/scala/pull/10118","tags":["x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36944","tags":["advisory"]},{"url":"https://github.com/scala/scala/releases/tag/v2.13.9","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/"},{"url":"https://github.com/advisories/GHSA-8qv5-68g4-248j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36944.json","tags":["advisory"]},{"url":"https://github.com/scala/scala","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI","tags":["web"]},{"url":"https://www.scala-lang.org/download","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-36944","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36944","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-36944","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-23T00:00:00Z","modified":"2025-05-27T14:56:43.802Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-6746","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-23T00:00:00Z","modified":"2025-05-27T14:56:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:38.348652Z"}],"ghsa":[{"id":"GHSA-8qv5-68g4-248j","title":"Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-25T00:00:20Z","modified":"2023-01-31T05:02:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:29.957996Z"}],"nvd":[{"id":"CVE-2022-36944","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-23T18:15:10.853Z","modified":"2026-06-17T04:54:19.363Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"CVE-2022-36944","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-23T00:00:00Z","modified":"2026-10-28T02:30:43.209114221Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-8qv5-68g4-248j","title":"Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"published","published":"2022-09-25T00:00:20Z","modified":"2026-09-10T03:49:45.276399316Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"UBUNTU-CVE-2022-36944","description":"Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.","status":"withdrawn","published":"2022-09-23T18:15:00Z","modified":"2025-07-14T06:46:02.378309Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ROOT-APP-MAVEN-CVE-2022-36944","title":"CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root","description":"Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-23T13:12:37Z","modified":"2026-06-23T18:30:21.373360653Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}