CVE-2022-36437: Hazelcast

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

Affected products

• Hazelcast Hazelcast: before 3.12.13 (fixed in 3.12.13); from 4.0.0, before 4.1.10 (fixed in 4.1.10); from 4.2.0, before 4.2.6 (fixed in 4.2.6); from 5.0.0, before 5.0.4 (fixed in 5.0.4); from 5.1.0, before 5.1.3 (fixed in 5.1.3)
• Hazelcast Hazelcast-Jet: before 4.5.4 (fixed in 4.5.4)

Published 2022-12-29. Last modified 2026-06-17.