GCVE - cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hazelcast:hazelcast:*:*:*:*:enterprise:*:*:*

part: a version: * update: *

Vendor	Hazelcast (`188878da-4b2c-52f5-8267-7bd4410c9d5a`)
Product	Hazelcast (`2c6b4c8a-ff2a-5e68-92d9-618440556d4f`)
Edition	*
Language	*
Software edition	enterprise
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/hazelcast/hazelcast`	purl2cpe	2026-06-01 10:11:14.702364
`pkg:github/hazelcast/hazelcast`	purl2cpe	2026-06-01 10:11:14.702366
`pkg:maven/com.hazelcast/hazelcast`	purl2cpe	2026-06-01 10:11:14.702367
`pkg:sourceforge/hazelcast.mirror`	purl2cpe	2026-06-01 10:11:14.702369

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-33265`	vulnerable	2026-06-08 06:06:22.154340	Details available In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted. Published: 2023-07-18T00:00:00.000Z Updated: 2024-10-28T18:31:09.582Z Open on db.gcve.eu Reference links https://github.com/hazelcast/hazelcast https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-36437`	vulnerable	2026-06-08 05:46:07.416934	Details available The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3. Published: 2022-12-29T00:00:00.000Z Updated: 2025-04-11T22:46:33.774Z Open on db.gcve.eu Reference links https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5hg-mr8r-f6jp	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26168`	vulnerable	2026-06-08 05:23:50.760907	Details available The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't verify properly the password in some system-user-dn scenarios. As a result, users (clients/members) can be authenticated even if they provide invalid passwords. Published: 2020-11-09T21:28:39.000Z Updated: 2024-08-04T15:49:07.227Z Open on db.gcve.eu Reference links https://docs.hazelcast.org/docs/ern/index.html#4-0-3 https://jet-start.sh/blog/2020/10/23/jet-43-is-released https://hazelcast.zendesk.com/hc/en-us/articles/360050161951--IMDG-Enterprise-4-0-4-0-1-4-0-2-LDAP-Authentication-Bypass https://hazelcast.zendesk.com/hc/en-us/articles/360051384932--JET-Enterprise-4-0-4-1-4-1-1-4-2-LDAP-Authentication-Bypass	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.