CVE-2022-36437: Hazelcast connection caching
Summary
CVE-2022-36437: Hazelcast connection caching. Affects com.hazelcast:hazelcast across 6 version ranges.
< 3.12.13
>= 4.0, <= 4.0.6
>= 4.1, < 4.1.10
>= 4.2, < 4.2.6
>= 5.0, < 5.0.4
>= 5.1, < 5.1.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hazelcast is an open-source in-memory data grid that provides distributed computing capabilities. It allows applications to store and process large amounts of data across a cluster of machines. The Hazelcast Connection handler is responsible for managing connections to the cluster. It has been discovered that the Connection handler in Hazelcast and Hazelcast Jet is vulnerable to an attack that allows an unauthenticated remote attacker to access and manipulate data in the cluster using the identity of another authenticated connection.
Vulnerability Detail
The vulnerability, identified as CVE-2022-36437, arises from a flaw in the Connection handler of Hazelcast and Hazelcast Jet. It allows an attacker to impersonate an authenticated connection and gain unauthorized access to the cluster. By exploiting this vulnerability, an attacker can potentially view, modify, or delete data within the cluster, leading to a breach of confidentiality and integrity. The vulnerability affects various versions of Hazelcast and Hazelcast Jet, including 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2.
How To Fix
Latest published version: 5.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.12.133.12.13 -
>= 4.1, < 4.1.104.1.10 -
>= 4.2, < 4.2.64.2.6 -
>= 5.0, < 5.0.45.0.4 -
>= 5.1, < 5.1.35.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
While there is no known workaround for this vulnerability, it is recommended to enable TLS and mutual authentication in the setup. This significantly reduces the risk of exploitation by enforcing secure communication between the cluster and clients.
Conclusion
The Hazelcast connection caching vulnerability (CVE-2022-36437) exposes a critical security flaw in the Connection handler of Hazelcast and Hazelcast Jet. It allows an attacker to impersonate an authenticated connection and gain unauthorized access to the cluster. To mitigate this vulnerability, it is crucial to update to the patched versions of the affected packages. Additionally, enabling TLS and mutual authentication can provide an added layer of security. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hazelcast:hazelcast →
FAQ
Hazelcast is an open-source in-memory data grid that provides distributed computing capabilities. It allows applications to store and process large amounts of data across a cluster of machines.
The vulnerability allows an unauthenticated remote attacker to access and manipulate data in the cluster using the identity of another authenticated connection. This can lead to unauthorized access, data modification, and potential breaches of confidentiality and integrity.
The vulnerability affects Hazelcast versions through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. It also affects Hazelcast Jet versions through 4.5.3.
To fix this vulnerability, it is recommended to update to the patched versions of the affected packages. Refer to the 'how_to_fix' section for the specific versions.
While there is no known workaround, enabling TLS and mutual authentication in the setup can significantly reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for com.hazelcast:hazelcast.
