CVE-2022-36437

9.1 criticalEPSS 1.1%

Critical (9.1) in hazelcast. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.hazelcast:hazelcast 3.12.13, 4.1.10, 4.2.6.

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2022-12-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hazelcast:hazelcast
hazelcast:hazelcast-jet

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	<3.12.13	3.12.13
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	>=4.0 <=4.0.6	no fix published
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	>=4.1 <4.1.10	4.1.10
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	>=4.2 <4.2.6	4.2.6
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	>=5.0 <5.0.4	5.0.4
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast	>=5.1 <5.1.3	5.1.3
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast.jet:hazelcast-jet	<4.5.4	4.5.4
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast.jet:hazelcast-jet-enterprise	<4.5.4	4.5.4
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	<3.12.13	3.12.13
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	>=4.0 <=4.0.6	no fix published
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	>=4.1 <4.1.10	4.1.10
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	>=4.2 <4.2.6	4.2.6
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	>=5.0 <5.0.4	5.0.4
GHSA-c5hg-mr8r-f6jp	Maven	com.hazelcast:hazelcast-enterprise	>=5.1 <5.1.3	5.1.3

References

Check your stack JSON