What’s Vulnerable › Vulnerabilities

CVE-2022-45047: Apache MINA SSHD: Java unsafe deserialization vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-16 · updated 2026-06-17
• Weakness: CWE-502

Description

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Affected products

• Apache Sshd: through 2.9.1

References

• https://security.netapp.com/advisory/ntap-20240216-0008/
• https://www.mail-archive.com/dev%40mina.apache.org/msg39312.html
• https://security.netapp.com/advisory/ntap-20240216-0008/
• https://www.mail-archive.com/dev%40mina.apache.org/msg39312.html

Get alerted when CVE-2022-45047 or the next vulnerability affects your stack