Hazelcast: Arbitrary member memory read by low-privileged client
Summary
Hazelcast, a Java-based real-time data platform and in-memory data grid, does not properly validate data sent by a client connected to a cluster. A malicious client that can reach a cluster member can read the member's Java heap, off-heap data and JVM process memory. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory, which may allow arbitrary code execution.
Affected
- Hazelcast versions before 5.4.5
- Hazelcast versions 5.5.0 to before 5.5.10
- Hazelcast versions 5.6.0 to before 5.6.1
- Slim and full distributions are affected
- Older lines (5.3.x and earlier) fall within the advisory range and are not patched; check with Hazelcast whether they are supported
Fixed in
- 5.4.5
- 5.5.10
- 5.6.1
- 5.7.0 (includes the Community fixes of Enterprise 5.6.1)
Workaround
Unknown.
Exploitation
- No confirmed in-the-wild exploitation found
- No public exploit known
- CISA SSVC: exploitation none, automatable yes, technical impact total
- EPSS 0.00383
Our recommendation
- Inventory all Hazelcast usage, including transitive Maven dependencies and Enterprise builds, and record each version
- Upgrade to 5.4.5, 5.5.10, 5.6.1 or 5.7.0, depending on your line, or to a vendor-supported build
- Restrict cluster member and client ports to trusted networks and confirm none are internet-facing
- Confirm that client security and authorization are enabled
- Prioritise internet-facing or partner-accessible clusters and Enterprise deployments
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6v25-8wq6-xq4j github.com
- Hazelcast 5.7 Community Edition release notes docs.hazelcast.com
- Hazelcast 5.7 Enterprise Edition release notes docs.hazelcast.com
- Hazelcast v5.7.0 release github.com
- Fix commit 361979da github.com
- GitLab advisory CVE-2026-107726 advisories.gitlab.com
- OSV CVE-2026-107726 osv.dev
- VulDB 415656 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:52.
Original description (NVD)
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
NVD references (5)
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/community
- https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise
- https://github.com/hazelcast/hazelcast/commit/361979da12f18950c24719db832ca6c5e7c0534f
- https://github.com/hazelcast/hazelcast/releases/tag/v5.7.0
- https://github.com/hazelcast/hazelcast/security/advisories/GHSA-6v25-8wq6-xq4j
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.