Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.ignite:ignite-core | < 2.4 | 2.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1295
- https://access.redhat.com/errata/RHSA-2018:2405
- https://github.com/advisories/GHSA-chp4-rv79-68j3
- https://github.com/apache/ignite
- https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209@%3Cdev.ignite.apache.org%3E
- https://web.archive.org/web/20200227125559/http://www.securityfocus.com/bid/103692
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Java / Kotlin (Maven)
- Package
org.apache.ignite:ignite-core- Disclosed
- 16.10.2018
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-chp4-rv79-68j3 - CC BY 4.0
Vulnerability history: org.apache.ignite:ignite-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 10.2018 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 4
- High 2
- Medium 1
Disclosures per year
- 2018: 4
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 1
-
Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.