# com.hazelcast:hazelcast (Maven) vulnerabilities 9 known vulnerabilities (2 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.7.0 (May 12, 2026): no advisory affects it - Newest unaffected release: 5.7.0 (May 12, 2026), the latest release - Dependents: 180 - Releases: 271 since 1.5 (Feb 27, 2009) - Registry: https://central.sonatype.com/artifact/com.hazelcast/hazelcast - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107726: 1.5 to 5.6.0 (5.7.0 is outside it) - CVE-2026-107725: 1.5 to 5.6.0 (5.7.0 is outside it) - CVE-2023-45859: 1.5 to 4.1.10 (4.2-BETA-1 is outside it); 4.2 to 4.2.8 (5.0-BETA-1 is outside it); 5.0 to 5.0.5 (5.1-BETA-1 is outside it); 5.1 to 5.1.7 (5.2-BETA-1 is outside it); 5.2.0 to 5.2.4 (5.2.5 is outside it); 5.3.0 to 5.3.4 (5.3.5 is outside it) - CVE-2023-45860: 1.5 to 5.1.7 (5.2-BETA-1 is outside it); 5.2.0 to 5.2.4 (5.2.5 is outside it); 5.3.0 to 5.3.4 (5.3.5 is outside it) - CVE-2023-33265: 1.5 to 5.0.4 (5.0.5 is outside it); 5.1 to 5.1.6 (5.1.7 is outside it); 5.2.0 to 5.2.3 (5.2.4 is outside it) - CVE-2023-33264: 4.0-BETA-1 to 5.0.4 (5.0.5 is outside it); 5.1-BETA-1 to 5.1.5 (5.1.6 is outside it); 5.2-BETA-1 to 5.2.3 (5.2.4 is outside it); 5.3.0-BETA-1 to 5.3.0-BETA-2 (5.3.0 is outside it) - CVE-2022-36437: 1.5 to 3.12.12 (3.12.13 is outside it); 4.0 to 4.0.6 (4.1-BETA-1 is outside it); 4.1 to 4.1.9 (4.1.10 is outside it); 4.2 to 4.2.5 (4.2.6 is outside it); 5.0 to 5.0.3 (5.0.4 is outside it); 5.1 to 5.1.2 (5.1.3 is outside it) - CVE-2022-0265: 5.1-BETA-1 (5.1 is outside it) - CVE-2016-10750: 1.5 to 3.11-BETA-1 (3.11 is outside it) ## Advisories (9) ### [CVE-2026-107726](https://cve.now/CVE-2026-107726): Hazelcast: Arbitrary member memory access by low-privileged client - Severity: Critical 9.3 - Published: Oct 8, 2026 - Affected: from 5.6.0, fixed in 5.7.0; from 5.5.0, fixed in 5.7.0; fixed in 5.7.0. - Fixed in 5.7.0 (released May 12, 2026, 149 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2026-107725](https://cve.now/CVE-2026-107725): Hazelcast: Authorization bypass in IMap Predicates API - Severity: High 8.7 - Published: Oct 8, 2026 - Affected: from 5.6.0, fixed in 5.7.0; from 5.5.0, fixed in 5.7.0; fixed in 5.7.0. - Fixed in 5.7.0 (released May 12, 2026, 149 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2023-45859](https://cve.now/CVE-2023-45859): In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some… - Severity: High 7.6 - Published: Feb 28, 2024 - Affected: through 4.1.10; from 4.2, through 4.2.8; from 5.0, through 5.0.5; from 5.1, through 5.1.7; from 5.2.0, fixed in 5.2.5; from 5.3.0, fixed in 5.3.5. - Fixed in 5.2.5 (released Feb 23, 2024, 5 days before disclosure) and 5.3.5 (released Oct 24, 2023, 127 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2023-45860](https://cve.now/CVE-2023-45860): In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. - Severity: Medium 6.5 - Published: Feb 16, 2024 - Affected: from 5.3.0, fixed in 5.3.5; from 5.2.0, fixed in 5.2.5; through 5.1.7. - Fixed in 5.2.5 (released Feb 23, 2024, 7 days after disclosure) and 5.3.5 (released Oct 24, 2023, 115 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2023-33265](https://cve.now/CVE-2023-33265): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing… - Severity: Unrated - Published: Jul 18, 2023 - Affected: from 5.2.0, fixed in 5.2.4; from 5.1.0, fixed in 5.1.7; fixed in 5.0.5. - Fixed in 5.0.5 (released Jun 28, 2023, 20 days before disclosure), 5.1.7 (released Jun 19, 2023, 29 days before disclosure) and 5.2.4 (released Jun 13, 2023, 35 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2023-33264](https://cve.now/CVE-2023-33264): In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member… - Severity: Unrated - Published: May 22, 2023 - Affected: from 4.0-BETA-1, through 4.2.8; from 5.0-BETA-1, fixed in 5.0.5; from 5.1-BETA-1, fixed in 5.1.6; from 5.2-BETA-1, fixed in 5.2.4; from 5.3.0-BETA-1, fixed in 5.3.0. - Fixed in 5.0.5 (released Jun 28, 2023, 37 days after disclosure), 5.1.6 (released May 10, 2023, 12 days before disclosure), 5.2.4 (released Jun 13, 2023, 22 days after disclosure) and 1 other version. - The latest release, 5.7.0, is not affected. ### [CVE-2022-36437](https://cve.now/CVE-2022-36437): The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the… - Severity: Critical 9.1 - Published: Dec 29, 2022 - Affected: fixed in 3.12.13; from 4.0, through 4.0.6; from 4.1, fixed in 4.1.10; from 4.2, fixed in 4.2.6; from 5.0, fixed in 5.0.4; from 5.1, fixed in 5.1.3. - Fixed in 3.12.13 (released Aug 25, 2022, 126 days before disclosure), 4.1.10 (released Nov 18, 2022, 41 days before disclosure), 4.2.6 (released Nov 25, 2022, 34 days before disclosure) and 2 other versions. - The latest release, 5.7.0, is not affected. ### [CVE-2022-0265](https://cve.now/CVE-2022-0265): Improper Restriction of XML External Entity Reference in hazelcast/hazelcast - Severity: High 7.3 - Published: Mar 3, 2022 - Affected: from 5.1-beta1, fixed in 5.1. - Fixed in 5.1 (released Feb 28, 2022, 3 days before disclosure). - The latest release, 5.7.0, is not affected. ### [CVE-2016-10750](https://cve.now/CVE-2016-10750): In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. - Severity: Unrated - Published: May 22, 2019 - Affected: fixed in 3.11. - Fixed in 3.11 (released Oct 23, 2018, 211 days before disclosure). - The latest release, 5.7.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.hazelcast:hazelcast Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.