CVE-2018-1295: Apache Ignite 2.3 or earlier - Arbitrary Code Execution
Summary
CVE-2018-1295: In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are... Affects org.apache.ignite:ignite-core versions < 2.4. Fixed in 2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ignite is an open-source distributed database, caching, and processing platform designed for high-performance computing and big data processing. It provides in-memory data storage and processing capabilities, allowing users to perform complex computations on large datasets. However, versions 2.3 and earlier of Apache Ignite suffer from a vulnerability that allows for arbitrary code execution.
Vulnerability Detail
The vulnerability in Apache Ignite arises from its serialization mechanism, which lacks a list of classes allowed for serialization/deserialization. This oversight enables an attacker to execute arbitrary code by sending a specially crafted serialized object to one of the deserialization endpoints of Ignite components such as the discovery SPI, Ignite persistence, Memcached endpoint, or socket steamer. By exploiting this vulnerability, an attacker can potentially run malicious code on the affected system, leading to unauthorized access, data manipulation, or denial of service.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and filtering mechanisms to ensure that only trusted and expected serialized objects are processed. This can be achieved by implementing custom deserialization filters or using libraries that provide secure deserialization capabilities. However, applying these workarounds may require significant code changes and may not provide complete protection against all possible attack vectors.
Conclusion
The vulnerability in Apache Ignite versions 2.3 and earlier allows for arbitrary code execution, potentially leading to unauthorized access, data manipulation, or denial of service. To mitigate this vulnerability, it is recommended to upgrade to Apache Ignite version 2.4 or later. Implementing input validation and filtering mechanisms can serve as a temporary workaround, but upgrading to a patched version is the most effective solution. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.ignite:ignite-core →
FAQ
Apache Ignite is an open-source distributed database, caching, and processing platform designed for high-performance computing and big data processing. It provides in-memory data storage and processing capabilities.
Versions 2.3 and earlier of Apache Ignite are affected by this vulnerability.
An attacker can exploit this vulnerability by sending a specially crafted serialized object to one of the deserialization endpoints of Ignite components, allowing them to execute arbitrary code on the affected system.
The potential consequences of this vulnerability include unauthorized access to sensitive data, data manipulation, and denial of service attacks.
Yes, upgrading to Apache Ignite version 2.4 or later will fix this vulnerability by implementing a list of allowed classes for serialization/deserialization.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ignite:ignite-core.
