What’s Vulnerable › Vulnerabilities

CVE-2022-24289: Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-11 · updated 2026-06-17
• Weakness: CWE-502

Description

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.

Affected products

• Apache Software Foundation Apache Cayenne: before 4.2 — fixed in 4.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Cayenne 4.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/02/11/1
• https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vc
• http://www.openwall.com/lists/oss-security/2022/02/11/1
• https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vc

Get alerted when CVE-2022-24289 or the next vulnerability affects your stack