CVE-2022-25647 — Deserialization of Untrusted Data

Description

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Affected products

Vendor	Product	Affected	Fixed
—	com.google.code.gson:gson	unspecified – < 2.8.9	2.8.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libgoogle-gson-java	2.9.0-1	—
Debian 13	libgoogle-gson-java	2.9.0-1	—
Debian 12	libgoogle-gson-java	2.9.0-1	—
Debian 11	libgoogle-gson-java	2.8.6-1+deb11u1	DSA-5227-1
Debian 10	libgoogle-gson-java	2.8.5-3+deb10u1	DLA-3100-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 9	libgoogle-gson-java	2.4-1+deb9u1	DLA-3001-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	libgoogle-gson-java	2.8.8-1ubuntu0.1	USN-6692-1
Ubuntu 20.04 LTS	libgoogle-gson-java	2.8.5-3+deb10u1build0.20.04.1	USN-6692-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	libgoogle-gson-java	2.8.5-3~18.04.1~esm1	USN-6692-1
Ubuntu Pro 16.04 LTS	libgoogle-gson-java	2.4-1ubuntu0.1~esm1	USN-6692-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Ocp Tools 4	jenkins	2.387.3.1684911776-3.el8	RHSA-2023:3299
Red Hat Ocp Tools 4	jenkins-2-plugins	4.13.1684911916-1.el8	RHSA-2023:3299
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-activemq-artemis +15	1.5.5.016-1.redhat_00001.1.ep7.el7	RHSA-2025:4437, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-activemq-artemis-tools	2.9.0-10.redhat_00021.1.el7eap	RHSA-2025:4437
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-artemis-native +1	1:1.5.5.016-1.redhat_00001.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-gson	2.8.9-1.redhat_00001.1.el7eap	RHSA-2025:4437
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-hal-console	3.2.18-1.Final_redhat_00001.1.el7eap	RHSA-2025:4437
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-server-migration +21	1.7.2-14.Final_redhat_00015.1.el7eap	RHSA-2025:4437
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-xnio-base	3.5.11-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:4437, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jsoup	1.14.2-1.redhat_00002.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-14.SP13_redhat_00001.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.10-2.GA_redhat_00002.1.ep7.el7	RHSA-2025:4437, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-javadocs +2	7.3.13-4.GA_redhat_00002.1.el7eap	RHSA-2025:4437
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-woodstox-core	5.0.3-2.redhat_00002.1.ep7.el7	RHSA-2025:4437, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-xml-security	2.0.10-2.redhat_00002.1.ep7.el7	RHSA-2025:4226
Red Hat JBoss EAP 7	eap7 +1	1-18.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-FastInfoset +1	1.2.13-11.1.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.16.0-9.redhat_00042.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-activemq-artemis-native	1:1.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-aesh-extensions	1.8.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-aesh-readline	2.2.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-agroal +3	1.3.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-antlr	2.7.7-54.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-beanutils	1.9.4-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-codec	1.15.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-collections	3.2.2-9.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-io	2.10.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-lang	3.11.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-commons-lang2	2.6.0-1.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.3.13-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-mime4j	0.6.0-4.1.redhat_7.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-apache-sshd	2.7.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-artemis-native +1	1:1.0.2-3.redhat_1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-artemis-wildfly-integration	1.0.4-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-atinject	1.0.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-avro	1.7.6-7.1.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-azure-storage	8.6.6-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-bouncycastle +4	1.68.0-2.redhat_00005.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-byte-buddy	1.11.12-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-caffeine	2.8.8-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cal10n	0.8.1-6.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-codehaus-jackson +4	1.9.13-10.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-commons-logging-jboss-logging	1.0.0-1.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cryptacular	1.2.4-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-cxf-xjc-dv +5	3.3.1-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-dom4j	2.1.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-ecj	1:3.26.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-eclipse-jgit	5.13.0.202109080827-1.r_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.9.2-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-fge-btf	1.2.0-1.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-fge-msg-simple	1.1.0-1.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-concurrent	1.1.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-jaf	1.2.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-javamail	1.6.5-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.14-4.SP05_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-glassfish-json	1.1.6-2.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-gnu-getopt	1.0.13-6.redhat_5.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-gson	2.8.9-1.redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-guava +1	30.1.0-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-guava-failureaccess	1.0.1-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-h2database	1.4.197-2.redhat_00004.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hal-console	3.3.13-1.Final_redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-hibernate +2	5.3.27-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-beanvalidation-api	2.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-commons-annotations	5.0.5-1.1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-search +5	5.10.7-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.23-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-hornetq +3	2.4.8-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-asyncclient	4.1.4-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-client	4.5.13-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-httpcomponents-core	4.4.14-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-infinispan +9	11.0.15-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.5.3-2.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-core +9	2.12.6-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-coreutils	1.8.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jackson-databind	2.12.6.1-2.redhat_00004.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jakarta-el	3.0.3-3.redhat_00007.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jakarta-security-enterprise-api	1.0.2-3.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jandex	2.4.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jansi	1.18.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jasypt	1.9.3-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-java-classmate	1.5.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaee-jpa-spec	2.2.3-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaee-security-soteria +1	1.0.1-3.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javaewah	1.1.7-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javapackages-tools +1	3.4.1-5.15.6.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-javassist	3.27.0-2.GA_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jaxbintros	1.0.3-1.GA_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jaxen	1.1.6-14.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jberet +1	1.3.9-2.SP2_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-aesh	2.4.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-classfilewriter	1.2.5-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-common-beans +2	2.0.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-dmr	1.5.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb-api_3.2_spec +7	2.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.44-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-ejb3-ext-api	2.3.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-el-api_3.0_spec +4	2.0.0-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-iiop-client +1	1.0.1-3.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-interceptors-api_1.2_spec	2.0.0-3.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-invocation	1.6.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-jaspi-api_1.1_spec +1	2.0.1-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-jsf-api_2.3_spec	3.0.0-5.SP06_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-logging	3.4.1-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-logmanager	2.1.18-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-marshalling +1	2.0.12-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-metadata +5	13.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-modules	1.12.0-2.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-msc	1.4.12-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-openjdk-orb	8.1.4-3.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-remoting	5.0.25-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-remoting-jmx	3.0.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-saaj-api_1.3_spec	1.0.6-1.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-saaj-api_1.4_spec	1.0.2-1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-seam-int	7.0.0-6.GA_redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-security-negotiation	3.0.6-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-security-xacml	2.0.8-17.Final_redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-server-migration +2	1.10.0-18.Final_redhat_00017.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-stdio +1	1.1.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-threads	2.4.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-transaction-api_1.3_spec	2.0.0-4.Final_redhat_00005.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-transaction-spi	7.6.0-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-vfs	3.2.16-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-weld-3.1-api +2	3.1.0-6.SP3_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.8.7-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-api	1.1.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-common	3.3.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-common-tools	1.3.2-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-cxf	5.4.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jbossws-spi	3.3.1-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jcip-annotations	1.0.0-5.redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jctools +1	2.1.2-1.redhat_00003.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jettison +1	1.4.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups	4.2.15-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups-azure	1.3.1-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jgroups-kubernetes	1.0.16-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-joda-time	2.9.7-2.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-json-patch	1.9.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jsonb-spec	1.0.2-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jsoup	1.14.2-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-jul-to-slf4j-stub	1.0.1-7.Final_redhat_3.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j	2.17.1-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j-jboss-logmanager	1.2.2-1.Final_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-log4j2-jboss-logmanager	1.0.0-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-lucene-core +7	5.5.5-3.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-mod_cluster	1.4.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-mustache-java +1	0.9.6-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-narayana +10	5.11.4-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-neethi	3.1.1-1.1.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty +27	4.1.77-1.Final_redhat_00001.1.el7eap	RHSA-2022:5894, RHSA-2022:5893, RHSA-2022:5892
Red Hat JBoss EAP 7	eap7-netty-tcnative	2.0.52-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty-transport-native-epoll	4.1.77-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-netty-xnio-transport	0.1.9-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-objectweb-asm	9.1.0-1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-opensaml +13	3.3.1-1.1.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketbox +1	5.0.3-10.Final_redhat_00009.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketbox-commons	1.0.0-4.final_redhat_5.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketlink-api +7	2.5.5-21.SP12_redhat_00011.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-picketlink-bindings +1	2.5.5-26.SP12_redhat_00014.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-protostream	4.3.5-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactive-streams	1.0.3-2.redhat_00003.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactivex-rxjava	3.0.9-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-reactivex-rxjava2	2.2.20-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-resteasy +18	3.15.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-shibboleth-java-support	7.3.0-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-slf4j +2	1.7.22-4.1.redhat_2.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-snakeyaml	1.29.0-1.redhat_00001.2.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-stax-ex	1.8.3-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-stax2-api	4.2.1-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-staxmapper	1.3.0-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-istack-commons +2	3.0.10-1.1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-saaj-1.3-impl	1.3.16-18.SP1_redhat_6.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-saaj-1.4-impl	1.4.1-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-sun-ws-metadata-2.0-api	1.0.0-7.MR1_redhat_8.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-taglibs-standard-impl +3	1.2.6-2.1.RC1_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-txw2 +7	2.3.3-4.1.b02_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow	2.2.18-2.SP2_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow-jastow +1	2.0.9-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-undertow-js	1.0.2-2.Final_redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-vdx +2	1.1.6-2.redhat_1.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-velocity +1	2.3.0-1.redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-weld-cdi-2.0-api	2.0.2-2.redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-weld-ejb +6	3.1.6-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly +2	7.4.6-5.GA_redhat_00002.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-client-config	1.0.1-2.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-common	1.5.4-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-discovery +1	1.2.1-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-elytron +1	1.15.13-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.1.12-1.SP1_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-naming-client	1.0.14-1.1.Final_redhat_00001.1.el9eap	RHSA-2022:5894
Red Hat JBoss EAP 7	eap7-wildfly-openssl	2.2.3-1.Final_redhat_00001.1.el9eap	RHSA-2022:5894

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SLES 15 SP3	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SLES 15 SP2	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1

Show 9 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP2	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SLE HPC 15 SP2	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Manager Server Module 4.3	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Manager Server Module 4.2	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Manager Server Module 4.1	google-gson	2.8.9-150200.3.7.1	SUSE-SU-2022:3706-1
SUSE Manager Server 4.1	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Manager Retail Branch Server 4.1	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Manager Proxy 4.1	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
SUSE Enterprise Storage 7	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Leap 15.4	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1
openSUSE Leap 15.3	google-gson	2.8.9-150200.3.6.3	SUSE-SU-2022:2044-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	openjdk11	11.0.16_p8-r0	—
Alpine v3.24	openjdk17	17.0.4_p8-r0	—
Alpine v3.23	openjdk11	11.0.16_p8-r0	—
Alpine v3.23	openjdk17	17.0.4_p8-r0	—
Alpine v3.22	openjdk11	11.0.16_p8-r0	—
Alpine v3.22	openjdk17	17.0.4_p8-r0	—
Alpine v3.21	openjdk11	11.0.16_p8-r0	—
Alpine v3.21	openjdk17	17.0.4_p8-r0	—
Alpine v3.20	openjdk11	11.0.16_p8-r0	—
Alpine v3.20	openjdk17	17.0.4_p8-r0	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	openjdk11	11.0.16_p8-r0	—
Alpine v3.19	openjdk17	17.0.4_p8-r0	—
Alpine v3.18	openjdk11	11.0.16_p8-r0	—
Alpine v3.18	openjdk13	13.0.12_p4-r0	—
Alpine v3.18	openjdk15	15.0.8_p4-r0	—
Alpine v3.18	openjdk17	17.0.4_p8-r0	—
Alpine v3.17	openjdk11	11.0.16_p8-r0	—
Alpine v3.17	openjdk13	13.0.12_p4-r0	—
Alpine v3.17	openjdk15	15.0.8_p4-r0	—
Alpine v3.17	openjdk17	17.0.4_p8-r0	—
Alpine v3.16	openjdk11	11.0.16_p8-r0	—
Alpine v3.16	openjdk13	13.0.12_p4-r0	—
Alpine v3.16	openjdk15	15.0.8_p4-r0	—
Alpine v3.16	openjdk17	17.0.4_p8-r0	—
Alpine v3.15	openjdk11	11.0.17_p8-r0	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 8	graalvm21-ce-11 +37	21.3.3-1.el8	ELSA-2022-9652, ELSA-2022-9651, ELSA-2022-9650
Oracle Linux 8	graalvm22-ce-11 +39	22.2.0-1.el8	ELSA-2022-9656, ELSA-2022-9655, ELSA-2022-9654
Oracle Linux 7	graalvm21-ce-11 +37	21.3.3-1.el7	ELSA-2022-9644, ELSA-2022-9643, ELSA-2022-9642
Oracle Linux 7	graalvm22-ce-11 +39	22.2.0-1.el7	ELSA-2022-9648, ELSA-2022-9647, ELSA-2022-9646

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	trino	439-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.google.code.gson:gson	< 2.8.9	2.8.9	GHSA-4jrv-ppp4-jm57

Advisories 46

RHSA-2025:4437 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.13 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2023:3299 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5894 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update. Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5892 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:5893 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
WID-SEC-2022-0909 IBM DB2: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 9, 2026
USN-6692-1 libgoogle-gson-java vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
DSA-5227-1 libgoogle-gson-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3001-1 libgoogle-gson-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-3100-1 libgoogle-gson-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2022:2044-1 Security update for google-gson SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
WID-SEC-2022-0759 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2025
WID-SEC-2022-0901 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 4, 2025
SUSE-SU-2022:3706-1 Security update for google-gson SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
WID-SEC-2024-1401 Atlassian Fisheye/Crucible: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 18, 2024
NCSC-2024-0231 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · May 22, 2024
WID-SEC-2024-1214 Atlassian Jira Software (Data Center und Server): Mehrere Schwachstellen BSI CERT-Bund (WID) · May 21, 2024
WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
WID-SEC-2023-2700 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
WID-SEC-2023-2993 Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence and Atlassian Jira Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 12, 2023
WID-SEC-2023-2676 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
WID-SEC-2023-2391 Atlassian Jira Software: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 19, 2023
WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
WID-SEC-2023-1017 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
WID-SEC-2023-0134 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
ELSA-2022-9655 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9645 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9651 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9643 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9649 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9646 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9656 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9648 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9652 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9641 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9654 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9644 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9650 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9642 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9653 Important: GraalVM Security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022
ELSA-2022-9647 Important: GraalVM Security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 26, 2022

CNA	v3.1	7.7
EUVD	v3.1	7.7
OSV:GHSA	v3.1	7.7

Deserialization of Untrusted Data

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

SUSE

openSUSE

Alpine

Oracle Linux

Wolfi

Affected packages

Advisories 46

References