Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.hazelcast:hazelcast

9 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
5.7.0 (May 12, 2026): no advisory affects it
Newest unaffected release
5.7.0 (May 12, 2026), the latest release
Advisories
9 · 2 critical, 3 high, 1 medium
Dependents
180
Releases
271 since 1.5 (Feb 27, 2009)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-107726
    Affects 1.5 to 5.6.0 (5.7.0 is outside it)
  • CVE-2026-107725
    Affects 1.5 to 5.6.0 (5.7.0 is outside it)
  • CVE-2023-45859
    Affects 1.5 to 4.1.10 (4.2-BETA-1 is outside it); 4.2 to 4.2.8 (5.0-BETA-1 is outside it); 5.0 to 5.0.5 (5.1-BETA-1 is outside it); 5.1 to 5.1.7 (5.2-BETA-1 is outside it); 5.2.0 to 5.2.4 (5.2.5 is outside it); 5.3.0 to 5.3.4 (5.3.5 is outside it)
  • CVE-2023-45860
    Affects 1.5 to 5.1.7 (5.2-BETA-1 is outside it); 5.2.0 to 5.2.4 (5.2.5 is outside it); 5.3.0 to 5.3.4 (5.3.5 is outside it)
  • CVE-2023-33265
    Affects 1.5 to 5.0.4 (5.0.5 is outside it); 5.1 to 5.1.6 (5.1.7 is outside it); 5.2.0 to 5.2.3 (5.2.4 is outside it)
  • CVE-2023-33264
    Affects 4.0-BETA-1 to 5.0.4 (5.0.5 is outside it); 5.1-BETA-1 to 5.1.5 (5.1.6 is outside it); 5.2-BETA-1 to 5.2.3 (5.2.4 is outside it); 5.3.0-BETA-1 to 5.3.0-BETA-2 (5.3.0 is outside it)
  • CVE-2022-36437
    Affects 1.5 to 3.12.12 (3.12.13 is outside it); 4.0 to 4.0.6 (4.1-BETA-1 is outside it); 4.1 to 4.1.9 (4.1.10 is outside it); 4.2 to 4.2.5 (4.2.6 is outside it); 5.0 to 5.0.3 (5.0.4 is outside it); 5.1 to 5.1.2 (5.1.3 is outside it)
  • CVE-2022-0265
    Affects 5.1-BETA-1 (5.1 is outside it)
  • CVE-2016-10750
    Affects 1.5 to 3.11-BETA-1 (3.11 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • CVE-2026-107726Critical 9.3

    Hazelcast: Arbitrary member memory access by low-privileged client

    Affected: from 5.6.0, fixed in 5.7.0; from 5.5.0, fixed in 5.7.0; fixed in 5.7.0.

    Fixed in 5.7.0 (released May 12, 2026, 149 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • Hazelcast: Authorization bypass in IMap Predicates API

    Affected: from 5.6.0, fixed in 5.7.0; from 5.5.0, fixed in 5.7.0; fixed in 5.7.0.

    Fixed in 5.7.0 (released May 12, 2026, 149 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some…

    Affected: through 4.1.10; from 4.2, through 4.2.8; from 5.0, through 5.0.5; from 5.1, through 5.1.7; from 5.2.0, fixed in 5.2.5; from 5.3.0, fixed in 5.3.5.

    Fixed in 5.2.5 (released Feb 23, 2024, 5 days before disclosure) and 5.3.5 (released Oct 24, 2023, 127 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • CVE-2023-45860Medium 6.5

    In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector.

    Affected: from 5.3.0, fixed in 5.3.5; from 5.2.0, fixed in 5.2.5; through 5.1.7.

    Fixed in 5.2.5 (released Feb 23, 2024, 7 days after disclosure) and 5.3.5 (released Oct 24, 2023, 115 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing…

    Affected: from 5.2.0, fixed in 5.2.4; from 5.1.0, fixed in 5.1.7; fixed in 5.0.5.

    Fixed in 5.0.5 (released Jun 28, 2023, 20 days before disclosure), 5.1.7 (released Jun 19, 2023, 29 days before disclosure) and 5.2.4 (released Jun 13, 2023, 35 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member…

    Affected: from 4.0-BETA-1, through 4.2.8; from 5.0-BETA-1, fixed in 5.0.5; from 5.1-BETA-1, fixed in 5.1.6; from 5.2-BETA-1, fixed in 5.2.4; from 5.3.0-BETA-1, fixed in 5.3.0.

    Fixed in 5.0.5 (released Jun 28, 2023, 37 days after disclosure), 5.1.6 (released May 10, 2023, 12 days before disclosure), 5.2.4 (released Jun 13, 2023, 22 days after disclosure) and 1 other version.

    The latest release, 5.7.0, is not affected.

  • CVE-2022-36437Critical 9.1

    The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the…

    Affected: fixed in 3.12.13; from 4.0, through 4.0.6; from 4.1, fixed in 4.1.10; from 4.2, fixed in 4.2.6; from 5.0, fixed in 5.0.4; from 5.1, fixed in 5.1.3.

    Fixed in 3.12.13 (released Aug 25, 2022, 126 days before disclosure), 4.1.10 (released Nov 18, 2022, 41 days before disclosure), 4.2.6 (released Nov 25, 2022, 34 days before disclosure) and 2 other versions.

    The latest release, 5.7.0, is not affected.

  • Improper Restriction of XML External Entity Reference in hazelcast/hazelcast

    Affected: from 5.1-beta1, fixed in 5.1.

    Fixed in 5.1 (released Feb 28, 2022, 3 days before disclosure).

    The latest release, 5.7.0, is not affected.

  • In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization.

    Affected: fixed in 3.11.

    Fixed in 3.11 (released Oct 23, 2018, 211 days before disclosure).

    The latest release, 5.7.0, is not affected.