{"cve":"CVE-2016-6814","nvd":{"published":"2018-01-18T18:29:00.233","modified":"2026-06-17T00:51:49.333","status":"Modified","description":"When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2017-0272.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"],"products":["apache:groovy","redhat:enterprise_linux_server"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2016-6814","score":0.17239,"percentile":0.97101,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xphj-m9cc-8fmq","url":"https://osv.dev/vulnerability/GHSA-xphj-m9cc-8fmq","summary":"Deserialization of Untrusted Data in Groovy","modified":"2024-10-17T16:23:10.153350Z","packages":[{"ecosystem":"Maven","name":"org.codehaus.groovy:groovy","purl":"pkg:maven/org.codehaus.groovy/groovy","ranges":[">=1.7.0 <2.4.8"],"fixed":["2.4.8"]},{"ecosystem":"Maven","name":"org.codehaus.groovy:groovy-all","purl":"pkg:maven/org.codehaus.groovy/groovy-all","ranges":[">=1.7.0 <2.4.8"],"fixed":["2.4.8"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}