CVE-2022-0265: XML External Entity Reference in Hazelcast
Summary
CVE-2022-0265: XML External Entity Reference in Hazelcast. Affects com.hazelcast:hazelcast versions >= 5.1-beta1, < 5.1. Fixed in 5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast is an open-source in-memory data grid solution that provides distributed caching, distributed computing, and distributed messaging capabilities. It is commonly used in Java applications to improve performance and scalability. However, a vulnerability has been discovered in Hazelcast that allows for XML External Entity (XXE) attacks.
Vulnerability Detail
The vulnerability arises from the use of the AbstractXmlConfigRootTagRecognizer() function in Hazelcast. This function utilizes a SAXParser generated from a SAXParserFactory without the FEATURE_SECURE_PROCESSING set. As a result, it becomes susceptible to XXE attacks, where an attacker can exploit the parsing of XML input to read arbitrary files or execute remote code. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Hazelcast is not immediately feasible, a temporary workaround is to disable the parsing of XML configuration files. This can be achieved by modifying the application's configuration to use alternative configuration formats, such as properties or YAML files.
Conclusion
The vulnerability CVE-2022-0265 in Hazelcast exposes applications to XML External Entity (XXE) attacks, which can result in unauthorized access, remote code execution, or denial of service. It is crucial to upgrade to Hazelcast version 5.1 or later and apply the recommended fix to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
Hazelcast is an open-source in-memory data grid solution that provides distributed caching, distributed computing, and distributed messaging capabilities. It is commonly used in Java applications to improve performance and scalability.
An XML External Entity (XXE) attack is a type of security vulnerability that exploits the parsing of XML input. By injecting malicious XML entities, an attacker can read arbitrary files or execute remote code.
This vulnerability allows an attacker to perform XXE attacks, potentially leading to unauthorized access to sensitive information, remote code execution, or denial of service.
To fix this vulnerability, upgrade to Hazelcast version 5.1 or later and ensure the FEATURE_SECURE_PROCESSING flag is set on the SAXParserFactory. Keeping software dependencies up to date is also important.
A temporary workaround is to disable the parsing of XML configuration files and use alternative formats such as properties or YAML files.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
