CVE-2015-3253: Apache Groovy

Critical severity, CVSS 9.8. EPSS: 41% chance of exploitation in the next 30 days.

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Affected products

• Apache Groovy: version 1.7.0 only; version 1.7.1 only; version 1.7.2 only; version 1.7.3 only; version 1.7.4 only; version 1.7.5 only; …
• Oracle Health Sciences Clinical Development Center: version 3.1.1 only; version 3.1.2 only
• Oracle Retail Order Broker Cloud Service: version 4.1 only; version 5.1 only; version 5.2 only; version 15.0 only
• Oracle Retail Service Backbone: version 13.0 only; version 13.1 only; version 13.2 only; version 14.0 only; version 14.1 only; version 15.0 only
• Oracle Retail Store Inventory Management: version 13.2 only; version 14.0 only; version 14.1 only
• Oracle Webcenter Sites: version 11.1.1.8.0 only; version 12.2.1 only

Published 2015-08-13. Last modified 2026-06-17.