Insecure Deserialization in Apache Commons Collection

CRITICAL 9.8CVE-2015-6420 · GHSA-6hgm-866r-3cjv · Published 15/12/2015 · updated 07/10/2026

Package	Affected versions	Patched versions
commons-collections:commons-collections Maven	`< 3.2.2`	`3.2.2`
net.sourceforge.collections:collections-generic Maven	`≤ 4.0.1`	No fix yet
org.apache.commons:commons-collections4 Maven	`< 4.1`	`4.1`
org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic Maven	`≤ 4.01`	No fix yet
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections Maven	`≤ 3.2.1`	No fix yet
commons collections apache	`= 4.0≥ 3.0, < 3.2.2`	`3.2.2`

Description

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.

NVD description

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free