Security Digest · Vulnerability record
CVE-2023-42809: Redisson vulnerable to Deserialization of Untrusted Data
Redisson is a Java Redis client that uses the Netty framework.
CVSS 9.4 Critical EPSS 1.1% · p65
Should you act?
Critical and remotely reachable
No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 1.1%, percentile 65: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 65% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes
org.redisson:redisson(Maven) < 3.22.0, fixed in 3.22.0. Check your lockfile, including transitive dependencies.
What it is
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue. Some post-fix advice is available. Do NOT use Kryo5Codec as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the setRegistrationRequired(false) call. On the contrary, KryoCodec is safe to use. The fix applied to SerializationCodec only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating SerializationCodec please use the SerializationCodec(ClassLoader classLoader, Set allowedClasses) constructor to restrict the allowed classes for deserialization.
From the GitHub advisory
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.
Some post-fix advice is available. Do NOT use Kryo5Codec as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the setRegistrationRequired(false) call. On the contrary, KryoCodec is safe to use. The fix applied to SerializationCodec only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating SerializationCodec please use the SerializationCodec(ClassLoader classLoader, Set allowedClasses) constructor to restrict the allowed classes for deserialization.
Weakness type: CWE-502.
Product: org.redisson:redisson (Maven) · Assigned by: GitHub_M · Published: 2023-10-04
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | org.redisson:redisson | < 3.22.0 | 3.22.0 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| redisson | redisson | < 3.22.0 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.7 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: none
- Privileges required: none (no login)
- User interaction: active
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 1.10% probability of exploitation activity in the next 30 days; percentile 65.
Timeline
- — CVE record published by GitHub_M
- — GitHub-reviewed advisory GHSA-4hvc-qwr2-f8rv published (critical)
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-4hvc-qwr2-f8rv github.com
- CVE.org record CVE-2023-42809 cve.org
- NVD entry CVE-2023-42809 nvd.nist.gov
Other references from the CVE record and advisory
- securitylab.github.com securitylab.github.com
- github.com github.com