Executive brief
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
Affected products
- Maven org.apache.ignite:ignite-core
Junglewise Threat Intelligence
CVE-2024-52577: Apache Ignite: Possible RCE when deserializing incoming messages by the server node
CVE-2024-52577 · Severity: low · CVSS 3.1 · Published 2025-02-14
Technologies: org.apache.ignite:ignite-core (Maven). Vendors: Maven.
Related threats
- Apache Ignite path traversal in REST API
- File system access via H2 in Apache Ignite
- Code execution via deserialization in org.apache.ignite:ignite-core
- Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
- Moderate severity vulnerability that affects org.apache.ignite:ignite-core