CVE-2022-37021: Apache Geode Deserialization of Untrusted Data
Summary
CVE-2022-37021: Apache Geode vulnerable to Deserialization of Untrusted Data. Affects org.apache.geode:geode-core across 3 version ranges.
< 1.12.16
>= 1.13.0, < 1.13.5
>= 1.14.0, < 1.14.1
Fixed in 1.12.16, 1.13.5 or 1.14.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching capabilities. It is commonly used in enterprise applications to improve scalability and reliability. However, versions up to 1.12.5, 1.13.4, and 1.14.0 of Apache Geode are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8.
Vulnerability Detail
The vulnerability in Apache Geode allows for the deserialization of untrusted data, which can lead to remote code execution and other malicious activities. This vulnerability specifically affects users who are still on Java 8 and are using JMX or RMI. Attackers can exploit this flaw to execute arbitrary code on the target system, potentially compromising the entire application and its data. The impact of this vulnerability is critical, with a CVSS score of 9.8.
How To Fix
Latest published version: 2.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.12.161.12.16 -
>= 1.13.0, < 1.13.51.13.5 -
>= 1.14.0, < 1.14.11.14.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not feasible, the workaround involves specifying "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. This workaround enables a global serial filter to protect against deserialization attacks involving JMX or RMI. It is important to configure the serial filter properly by specifying any user classes that may be serialized/deserialized.
Conclusion
Apache Geode versions up to 1.12.5, 1.13.4, and 1.14.0 are vulnerable to a critical deserialization of untrusted data flaw. To mitigate this vulnerability, it is crucial to upgrade to Apache Geode 1.15 and Java 11. Alternatively, the workaround of enabling a global serial filter can be used, but it may impact performance. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geode:geode-core →
FAQ
Apache Geode is an open-source, distributed, in-memory data grid that provides high-performance data management and caching capabilities. It is commonly used in enterprise applications to improve scalability and reliability.
Versions up to 1.12.5, 1.13.4, and 1.14.0 of Apache Geode are vulnerable to this deserialization of untrusted data flaw.
The impact of this vulnerability is critical, with a CVSS score of 9.8. It allows for the deserialization of untrusted data, which can lead to remote code execution and other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrading to Apache Geode 1.15 and specifying "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers can provide protection.
The workaround involves upgrading to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not feasible, the workaround is to specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geode:geode-core.
