Scala Collection Compat
Approved changes feed: RSS · Atom
cpe:2.3:a:scala-lang:scala-collection-compat:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Scala Lang (38604b7b-30c4-5333-b7a4-da4504e4504b) |
|---|---|
| Product | Scala Collection Compat (33434bb1-ff6a-536a-b9b1-fe5103454de9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/scala/scala-collection-compat |
purl2cpe | 2026-06-01 10:15:13.642167 |
pkg:maven/org.scala-lang.modules/scala-collection-compat_3 |
purl2cpe | 2026-06-01 10:15:13.642170 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-36944 |
vulnerable | 2026-06-08 05:46:08.124525 |
Details available
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Published: 2022-09-23T00:00:00.000Z
Updated: 2025-05-27T14:56:43.802Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.