---
title: "CVE-2023-42809: Redisson vulnerable to Deserialization of Untrusted Data"
url: https://erroneo.us/security/cve/CVE-2023-42809/
description: "CVE-2023-42809 (org.redisson:redisson (Maven)): Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-10-04
date_modified: 2024-09-19
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-42809"
kev: false
cvss: 9.4
epss: 0.01101
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-42809: Redisson vulnerable to Deserialization of Untrusted Data

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 1.1% , percentile 65: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 65% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes org.redisson:redisson (Maven) < 3.22.0, fixed in 3.22.0 . Check your lockfile, including transitive dependencies.

## What it is

Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue. Some post-fix advice is available. Do NOT use Kryo5Codec as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the setRegistrationRequired(false) call. On the contrary, KryoCodec is safe to use. The fix applied to SerializationCodec only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating SerializationCodec please use the SerializationCodec(ClassLoader classLoader, Set allowedClasses) constructor to restrict the allowed classes for deserialization.

## Affected packages

- Maven `org.redisson:redisson` < 3.22.0 → fixed: 3.22.0

## Affected products (CVE record)

- redisson redisson: < 3.22.0

## Severity

- GitHub_M CVSS 3.1: 9.7 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.10% probability of exploitation activity in the next 30 days; percentile 65.

## Sources

- [GitHub Advisory GHSA-4hvc-qwr2-f8rv](https://github.com/advisories/GHSA-4hvc-qwr2-f8rv)
- [CVE.org record CVE-2023-42809](https://www.cve.org/CVERecord?id=CVE-2023-42809)
- [NVD entry CVE-2023-42809](https://nvd.nist.gov/vuln/detail/CVE-2023-42809)
- [securitylab.github.com](https://securitylab.github.com/advisories/GHSL-2023-053_Redisson/)
- [github.com](https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe)

---
Source page: https://erroneo.us/security/cve/CVE-2023-42809/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt