CVE-2016-10750: Hazelcast Deserialization of Untrusted Data
Summary
CVE-2016-10750: Deserialization of Untrusted Data in Hazelcast. Affects com.hazelcast:hazelcast versions < 3.11. Fixed in 3.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast is an open-source in-memory data grid solution that provides distributed computing capabilities. It allows applications to distribute data across multiple nodes in a cluster, providing high availability and scalability. Hazelcast is commonly used in Java-based applications to improve performance and reliability. However, versions before 3.11 are vulnerable to remote code execution through Java deserialization.
Vulnerability Detail
The vulnerability in Hazelcast arises during the cluster join procedure, where a remote attacker can exploit the deserialization of untrusted data. By sending a crafted JoinRequest to a listening Hazelcast instance, an attacker can execute arbitrary code if vulnerable classes exist in the classpath. This can lead to unauthorized access, data manipulation, or even a complete compromise of the affected system.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict network access to the Hazelcast instance. By limiting access to trusted networks or implementing network segmentation, the risk of exploitation can be mitigated. However, this is only a temporary solution, and upgrading to the patched version is strongly advised.
Conclusion
In conclusion, the Hazelcast vulnerability CVE-2016-10750 allows remote code execution through Java deserialization. Upgrading to version 3.11 or later is the recommended solution to fix this vulnerability. If immediate upgrade is not possible, restricting network access to the Hazelcast instance can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
Hazelcast is an open-source in-memory data grid solution that provides distributed computing capabilities. It is commonly used in Java-based applications to improve performance and reliability.
The vulnerability allows remote code execution, which can lead to unauthorized access, data manipulation, or a complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to Hazelcast version 3.11 or later.
A temporary workaround is to restrict network access to the Hazelcast instance by limiting access to trusted networks or implementing network segmentation.
Yes, if you don't upgrade, your system will remain vulnerable to remote code execution attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
