CVE-2024-52577
published 2025-02-14CVE-2024-52577: In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could…
PriorityP264critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
EPSS
2.66%
84.0th percentile
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ignite | >= 2.6.0 < 2.17.0 | 2.17.0 |
| apache_software_foundation | apache_ignite | >= 2.6.0 < 2.17.0 | 2.17.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability affects Apache Ignite server endpoints that fail to enforce configured Class Serialization Filters during deserialization of incoming messages; monitor for unexpected deserialization activity on Ignite server ports. ↗
- →Exploitation requires network access to vulnerable Ignite endpoints; restrict untrusted network access to Apache Ignite server ports as a detection/prevention boundary. ↗
- →The attack vector is remotely exploitable over HTTP (CVSS 9.8); monitor HTTP traffic to Apache Ignite endpoints for anomalous or oversized serialized payloads. ↗
- ·Affected versions are Apache Ignite 2.6.0 through 2.16.x (before 2.17.0); upgrade to 2.17.0 or later to remediate. ↗
- ·Class Serialization Filters, even when configured, are not enforced on some Ignite endpoints in vulnerable versions — do not rely on filter configuration alone as a security control on unpatched instances. ↗
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_oracle9.8CRITICAL
vendor_redhat9.5CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle GoldenGate Risk Matrix: General (Apache Ignite) — CVE-2024-52577
vendor_oracle·2025-10-15·CVSS 9.8
CVE-2024-52577 [CRITICAL] Oracle Oracle GoldenGate Risk Matrix: General (Apache Ignite) — CVE-2024-52577
Oracle Oracle GoldenGate Risk Matrix: General (Apache Ignite) vulnerability
CVE: CVE-2024-52577
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Red Hat
org.apache.ignite:ignite-core: Apache Ignite: Possible RCE when deserializing incoming messages by the server node
vendor_redhat·2025-02-14·CVSS 9.5
CVE-2024-52577 [CRITICAL] CWE-502 org.apache.ignite:ignite-core: Apache Ignite: Possible RCE when deserializing incoming messages by the server node
org.apache.ignite:ignite-core: Apache Ignite: Possible RCE when deserializing incoming messages by the server node
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
A flaw was found in Apache Ignite. This vulnerability allows remote code execution via specially crafted Ignite messages that bypass Class Serialization Filters.
Statement: No Red Hat products are affe
OSV
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
osv·2025-02-14
CVE-2024-52577 [CRITICAL] Apache Ignite: Possible RCE when deserializing incoming messages by the server node
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
GHSA
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
ghsa·2025-02-14
CVE-2024-52577 [CRITICAL] CWE-502 Apache Ignite: Possible RCE when deserializing incoming messages by the server node
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-14
Published