CVE-2024-52577: Apache Ignite Core RCE Vulnerability Due to Ignored Class Serialization Filters
Summary
CVE-2024-52577: Apache Ignite: Possible RCE when deserializing incoming messages by the server node. Affects org.apache.ignite:ignite-core versions >= 2.6.0, < 2.17.0. Fixed in 2.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ignite is an open-source distributed database and computing platform designed for high-performance computing. It provides in-memory data storage, distributed caching, and processing capabilities, making it suitable for real-time analytics and data processing. However, certain versions of Ignite are vulnerable to a critical remote code execution (RCE) issue due to improper handling of class serialization filters, which can be exploited by attackers to execute arbitrary code on the server.
Vulnerability Detail
In Apache Ignite versions from 2.6.0 to before 2.17.0, configured Class Serialization Filters are ignored for specific Ignite endpoints. This vulnerability arises when an attacker crafts a malicious Ignite message containing a vulnerable object class that exists in the Ignite server's classpath. Upon deserialization of such a message by the Ignite server, it may lead to the execution of arbitrary code, compromising the server's integrity and security.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.17.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as restricting access to Ignite server endpoints and monitoring incoming messages for suspicious patterns. However, this does not replace the need for an upgrade to the patched version.
Conclusion
The Apache Ignite vulnerability CVE-2024-52577 poses a significant risk due to improper handling of class serialization filters, allowing for potential remote code execution. It is essential for users to upgrade to version 2.17.0 or later to mitigate this risk. Implementing additional security measures can provide temporary relief, but upgrading is the most effective solution.
See every vulnerability recorded for org.apache.ignite:ignite-core →
FAQ
The vulnerability allows attackers to execute arbitrary code on the Apache Ignite server, potentially leading to data breaches or service disruptions.
Apache Ignite versions from 2.6.0 to before 2.17.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without any signup.
If an immediate upgrade is not possible, implement security measures such as restricting access to the server and monitoring for unusual activity as a temporary workaround.
More information can be found in the official Apache Ignite documentation and vulnerability advisories, as well as on platforms like Vulert.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ignite:ignite-core.
