Hazecast Enterprise 5.7.1/5.7.0 Release Notes: Fixes for Deserialization and Jackson CVEs

Vulnerability Overview This webpage screenshot primarily introduces the release notes for Hazecast Enterprise Edition versions 5.7.1 and 5.7.0, which include fixes and improvements for multiple security vulnerabilities. Affected Versions Version 5.7.1: - Fixed multiple security vulnerabilities, including several CVEs in the Jackson library (e.g., CVE-2026-5816, CVE-2026-2332, etc.). - Fixed issues related to Jet serialization functions, Jet path and class loading validation, client-side deserialization, Spring class reflection access, SQL object creation and method invocation, serialized arrays, Jackson serialization classes, Jet path and class loading validation, client-side deserialization, Spring class reflection access, SQL object creation and method invocation, serialized arrays, and Jackson serialization classes. Version 5.7.0: - Fixed multiple security vulnerabilities, including several CVEs in the Jackson library (e.g., CVE-2026-5816, CVE-2026-2332, etc.). - Fixed issues related to Jet serialization functions, Jet path and class loading validation, client-side deserialization, Spring class reflection access, SQL object creation and method invocation, serialized arrays, Jackson serialization classes, Jet path and class loading validation, client-side deserialization, Spring class reflection access, SQL object creation and method invocation, serialized arrays, and Jackson serialization classes. Remediation Version 5.7.1: - Improved validation of serializable Jet functions to prevent connections from attacker-controlled clusters or arbitrary addresses. - Prevented arbitrary file reading via Jet. - Removed exposure from the experimental declarative pipeline feature. - Ensured SQL is enabled before deserializing messages. - Enforced checks during class deserialization. - Blocked serializable Jackson classes. - Hardened Jet path and class loading validation. - Hardened client-side deserialization. - Blocked reflection access via Spring classes. - Hardened SQL object creation and method invocation. - Rejected malformed serialized arrays. - Resolved vulnerabilities in Jackson. - Addressed high-severity and critical CVEs identified by security scans. Version 5.7.0: - Improved validation of serializable Jet functions to prevent connections from attacker-controlled clusters or arbitrary addresses. - Prevented arbitrary file reading via Jet. - Removed exposure from the experimental declarative pipeline feature. - Ensured SQL is enabled before deserializing messages. - Enforced checks during class deserialization. - Blocked serializable Jackson classes. - Hardened Jet path and class loading validation. - Hardened client-side deserialization. - Blocked reflection access via Spring classes. - Hardened SQL object creation and method invocation. - Rejected malformed serialized arrays. - Resolved vulnerabilities in Jackson. - Addressed high-severity and critical CVEs identified by security scans. POC Code or Exploit Code No specific POC code or exploit code was included in the page. Summary Hazecast Enterprise Edition versions 5.7.1 and 5.7.0 fixed multiple security vulnerabilities, including several CVEs in the Jackson library, and improved Jet serialization functions, Jet path and class loading validation, client-side deserialization, Spring class reflection access, SQL object creation and method invocation, serialized arrays, and Jackson serialization classes. These fixes enhance system security and mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Hazecast Enterprise 5.7.1/5.7.0 Release Notes: Fixes for Deserialization and Jackson CVEs

More from this source