CVE-2016-10750
HIGHHazelcast < 3.11 - Insecure Deserialization
Title source: ruleDescription
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Scores
CVSS v3
8.1
EPSS
0.0292
EPSS Percentile
86.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
published
Affected Products (2)
hazelcast/hazelcast
< 3.11
com.hazelcast/hazelcast
< 3.11Maven
Timeline
Published
May 22, 2019
Tracked Since
Feb 18, 2026