Skip to content
Heist/ feed
Critical

Hazelcast: Arbitrary member memory access by low-privileged client

Type: advisorySource: Official CVE List1 source record

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.

Announced Source revision 1
Original source ↗

CVE-2026-107726

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-107726

hazelcast

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "hazelcast",
    "product": "hazelcast",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.4.5"
      },
      {
        "status": "affected",
        "version": ">= 5.5.0, < 5.5.10"
      },
      {
        "status": "affected",
        "version": ">= 5.6.0, < 5.6.1"
      }
    ]
  }
]
Related CVEs
CVE-2026-107726

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#16299 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement