CVE-2022-37023: Apache Geode - Deserialization of Untrusted Data
Summary
CVE-2022-37023: Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data. Affects org.apache.geode:geode-core versions < 1.15.0. Fixed in 1.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Geode is an open-source, distributed, in-memory data grid that provides a scalable and reliable platform for caching and data management. It is commonly used in high-performance applications that require low-latency data access. However, versions prior to 1.15.0 are susceptible to a deserialization of untrusted data vulnerability when utilizing the REST API on Java 8 or Java 11.
Vulnerability Detail
The deserialization of untrusted data flaw in Apache Geode allows an attacker to exploit the REST API by injecting malicious serialized objects. This can lead to remote code execution or other unauthorized actions. The vulnerability affects versions prior to 1.15.0 and poses a moderate risk. It is important for users to upgrade to Apache Geode 1.15.0 and follow the documentation to enable additional security measures such as "validate-serializable-objects=true" and specifying user classes with "serializable-object-filter". However, enabling "validate-serializable-objects" may impact performance.
How To Fix
Latest published version: 2.0.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.15.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The deserialization of untrusted data vulnerability in Apache Geode can be mitigated by upgrading to version 1.15.0 or later and implementing the recommended security measures. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.geode:geode-core →
FAQ
Apache Geode is an open-source, distributed, in-memory data grid that provides a scalable and reliable platform for caching and data management.
Versions prior to 1.15.0 are vulnerable to the deserialization of untrusted data flaw.
Exploiting this vulnerability can lead to remote code execution or unauthorized actions.
Upgrade to Apache Geode 1.15.0 or later and enable the "validate-serializable-objects" feature while specifying user classes with the "serializable-object-filter".
Enabling this feature may have an impact on performance. It is recommended to evaluate the performance impact in your specific use case.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.geode:geode-core.
