VYPR
← All advisories
High severityNVD Advisory· Published May 1, 2022· Updated Sep 17, 2024

Deserialization of Untrusted Data

CVE-2022-25647

Description

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Gson before 2.8.9 allows denial of service via deserialization of untrusted data using the writeReplace() method in internal classes.

Vulnerability

Gson versions before 2.8.9 are vulnerable to a deserialization of untrusted data issue via the writeReplace() method in certain internal classes [1][3]. This vulnerability affects the com.google.code.gson:gson package and can be triggered when an attacker provides a crafted serialized object that is deserialized by the application [3]. The vulnerable internal classes can be used in a deserialization attack path that may lead to denial of service [1][3].

Exploitation

An attacker who can supply a malicious serialized Java object to an endpoint that uses Gson for deserialization can exploit this vulnerability [3]. The attack requires no authentication if the application accepts untrusted input over the network [3]. By sending a specially crafted object that leverages the writeReplace() method in internal Gson classes, the attacker can trigger excessive resource consumption or cause the application to crash [1][3]. The complexity of exploitation is low, as the vulnerable code path can be reached with basic deserialization operations [3].

Impact

Successful exploitation results in a denial of service (DoS) condition [1][3]. The attacker can cause the application to become unresponsive or crash, affecting availability. No file disclosure, remote code execution, or privilege escalation is indicated by the available references [1][3]. The impact is limited to availability, and the severity is considered medium (CVSS 5.5) [1].

Mitigation

Upgrade com.google.code.gson:gson to version 2.8.9 or higher [3]. The fix was implemented in pull request #1991 on the official GitHub repository, which prevents the deserialization of internal classes [4]. As of the publication date (2022-05-01), the fix is available and should be applied to any affected deployments [1][3]. If upgrading is not immediately possible, ensure that untrusted data is not deserialized, or use a secure deserialization library [3].

References
  1. NVD - CVE-2022-25647
  2. Snyk Vulnerability Database | Snyk
  3. Prevent Java deserialization of internal classes by Marcono1234 · Pull Request #1991 · google/gson

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.google.code.gson:gsonMaven
< 2.8.92.8.9

Affected products

116

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.