Description
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | groovy | 2.4.8-1 | — |
| Debian 13 | groovy | 2.4.8-1 | — |
| Debian 12 | groovy | 2.4.8-1 | — |
| Debian 7 | groovy | 1.8.6-1+deb7u2 | DLA-794-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | groovy | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | groovy2 | 2.4.5-1ubuntu0.1~esm1 | USN-4795-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | groovy +1 | 1.8.9-8.el7_4 | RHSA-2017:2486 |
| RHEL 2 | rh-maven33-groovy +1 | 1.8.9-7.19.el6 | RHSA-2017:2596 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | groovy +1 | 1.8.9-8.el7_4 | ELSA-2017-2486 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.codehaus.groovy:groovy | >= 1.7.0, < 2.4.8 | 2.4.8 | GHSA-xphj-m9cc-8fmq |
| Maven | org.codehaus.groovy:groovy-all | >= 1.7.0, < 2.4.8 | 2.4.8 | GHSA-xphj-m9cc-8fmq |
Advisories 5
- RHSA-2017:2596 Red Hat Security Advisory: rh-maven33-groovy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2017:2486 Red Hat Security Advisory: groovy security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-4795-1 groovy2 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-794-1 groovy - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2017-2486 Important: groovy security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 17, 2017
References
- RHSA-2017:2596 vendor-advisory
- RHSA-2017:0868 vendor-advisory
- RHSA-2017:2486 vendor-advisory
- RHSA-2017:0272 vendor-advisory
- 95429 vdb-entry
- 1039600 vdb-entry
- GLSA-202003-01 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E