Critical severity9.1NVD Advisory· Published Dec 29, 2022· Updated Jun 17, 2026
CVE-2022-36437
CVE-2022-36437
Description
The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.hazelcast:hazelcastMaven | < 3.12.13 | 3.12.13 |
com.hazelcast:hazelcastMaven | >= 4.0, <= 4.0.6 | — |
com.hazelcast:hazelcastMaven | >= 4.1, < 4.1.10 | 4.1.10 |
com.hazelcast:hazelcastMaven | >= 4.2, < 4.2.6 | 4.2.6 |
com.hazelcast:hazelcastMaven | >= 5.0, < 5.0.4 | 5.0.4 |
com.hazelcast:hazelcastMaven | >= 5.1, < 5.1.3 | 5.1.3 |
com.hazelcast.jet:hazelcast-jetMaven | < 4.5.4 | 4.5.4 |
com.hazelcast.jet:hazelcast-jet-enterpriseMaven | < 4.5.4 | 4.5.4 |
com.hazelcast:hazelcast-enterpriseMaven | < 3.12.13 | 3.12.13 |
com.hazelcast:hazelcast-enterpriseMaven | >= 4.0, <= 4.0.6 | — |
com.hazelcast:hazelcast-enterpriseMaven | >= 4.1, < 4.1.10 | 4.1.10 |
com.hazelcast:hazelcast-enterpriseMaven | >= 4.2, < 4.2.6 | 4.2.6 |
com.hazelcast:hazelcast-enterpriseMaven | >= 5.0, < 5.0.4 | 5.0.4 |
com.hazelcast:hazelcast-enterpriseMaven | >= 5.1, < 5.1.3 | 5.1.3 |
Affected products
5- ghsa-coords4 versionspkg:maven/com.hazelcast/hazelcastpkg:maven/com.hazelcast/hazelcast-enterprisepkg:maven/com.hazelcast.jet/hazelcast-jetpkg:maven/com.hazelcast.jet/hazelcast-jet-enterprise
< 3.12.13+ 3 more
- (no CPE)range: < 3.12.13
- (no CPE)range: < 3.12.13
- (no CPE)range: < 4.5.4
- (no CPE)range: < 4.5.4
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-c5hg-mr8r-f6jpghsaADVISORY
- github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jpnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-36437ghsaADVISORY
- support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437ghsaWEB
News mentions
0No linked articles in our index yet.