XML External Entity Reference in Hazelcast

CRITICAL 9.8CVE-2022-0265 · GHSA-99wh-973f-779p · Published 03/03/2022 · updated 17/06/2026

In short

CVE-2022-0265 is a CRITICAL (CVSS 9.8) vulnerability affecting com.hazelcast:hazelcast, hazelcast (hazelcast).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.4% of all vulnerabilities.
Fix: update to 5.1 or later.

Package	Affected versions	Patched versions
com.hazelcast:hazelcast Maven	`≥ 5.1-beta1, < 5.1`	`5.1`
hazelcast hazelcast	`= 5.1`	No fix yet

Description

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

NVD description

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

References

nvd.nist.gov/vuln/detail/CVE-2022-0265 · ADVISORY
hazelcast/hazelcast#20407 · WEB
hazelcast/hazelcast commit 4d6b666 · WEB
hazelcast/hazelcast · WEB
huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563 · WEB

More vulnerabilities in com.hazelcast:hazelcast

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.hazelcast:hazelcast

Maven

≥ 5.1-beta1, < 5.1

5.1

hazelcast

= 5.1

No fix yet

More vulnerabilities in com.hazelcast:hazelcast

See all →