CVE-2022-25647

    Dashboard / Vulnerabilities / CVE-2022-25647

    CVE-2022-25647

    Published: 1 May 2022Last Modified: 12 Aug 2026

    Summary: Deserialization of Untrusted Data

    Details: The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

    References: https://github.com/google/gson/pull/1991/commits, https://www.oracle.com/security-alerts/cpujul2022.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25647.json, https://nvd.nist.gov/vuln/detail/CVE-2022-25647, https://security.netapp.com/advisory/ntap-20220901-0009/, https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327, https://www.debian.org/security/2022/dsa-5227, https://github.com/google/gson/pull/1991, https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html, https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d260faffee51cb3b5d04a2a6fc09f079e2ae990f
    Fixed -6a368d89da37917be7714c3072b8378f4120110a

    Affected versions

    20.3.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-25647 | CVE-DB