Hazelcast Arbitrary Memory Access by Low-Privileged Client (CVE-2026-107226)

Vulnerability Overview Vulnerability Name: Arbitrary member memory access by low-privileged client Vulnerability ID: GHSA-6v25-8wq0-xq4j CVE ID: CVE-2026-107226 CVSS v4 Base Metrics: 9.3/10 Vulnerability Type: CWE-20 Publication Date: August 3, 2026 Affected Versions: - com.hazelcast:hazelcast (Maven) - Affected versions: = 5.6.0, >= 5.5.0, < 5.5.10, < 5.4.5 - Patched versions: 5.6.1, 5.7.0, 5.5.10, 5.4.5 Impact Scope Vulnerability Description: - A vulnerability has been discovered in Hazelcast Enterprise Edition and Community Edition that allows a low-privilege malicious client to read arbitrary data from any member within the cluster, including Java heap memory, off-heap data, and the JVM process address space. - Additionally, such clients can cause one or more cluster members to crash, or corrupt memory contents in certain Enterprise Edition configurations, potentially leading to remote code execution. - All minimal and full distributions are affected. Remediation Patches: - Enterprise customers should upgrade to a patched version of Hazelcast Enterprise Edition: - 5.7.0 - 5.6.1 - 5.5.10 - 5.4.5 - Customers with extended support contracts should contact Hazelcast Support for patch information for older versions. - Community Edition users should upgrade to version 5.7.0. Recommendations: - Hazelcast also recommends all customers follow the recommendations in their security hardening guide, including: - Ensure Hazelcast security is enabled and client authorization is enforced. - Define an explicit allowlist for zero-config Compact serialization. - Avoid deploying clients on internet-facing insecure networks or on insecure hosts. - Ensure your Hazelcast cluster is properly protected by firewall rules. - Disable any features you are not using. Workarounds: - If you cannot immediately upgrade to the patched version, restrict cluster access to trusted clients and ensure those clients are hardened against compromise. References Security Advisory on the Hazelcast Support Portal

Goal Reached Thanks to every supporter — we hit 100%!

Hazelcast Arbitrary Memory Access by Low-Privileged Client (CVE-2026-107226)

More from this source