Description
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HyperSQL DataBase | hsqldb | unspecified – < 2.7.1 | 2.7.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | hsqldb | 2.7.1-1 | — |
| Debian 13 | hsqldb | 2.7.1-1 | — |
| Debian 12 | hsqldb | 2.7.1-1 | — |
| Debian 11 | hsqldb | 2.5.1-1+deb11u1 | DSA-5313-1 |
| Debian 10 | hsqldb | 2.4.1-2+deb10u1 | DLA-3234-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | hsqldb | No fix yet | — |
| Ubuntu 26.04 LTS | hsqldb | No fix yet | — |
| Ubuntu 25.10 | hsqldb | No fix yet | — |
| Ubuntu 24.04 LTS | hsqldb | No fix yet | — |
| Ubuntu 22.04 LTS | hsqldb | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | hsqldb | No fix yet | — |
| Ubuntu 18.04 LTS | hsqldb | No fix yet | — |
| Ubuntu 16.04 LTS | hsqldb | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | hsqldb +3 | 1:1.8.1.3-15.el7_9 | RHSA-2022:8560 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 ELS | hsqldb +3 | 1:1.8.0.10-13.el6_10 | RHSA-2022:8559 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-3.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-2.redhat_00003.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-2.redhat_00005.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.10-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-2.Final_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.8-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-26.redhat_00015.1.ep7.el7 | RHSA-2024:10208, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.2.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-native | 1:1.0.2-3.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-apache-mime4j | 0.8.9-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-4.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.7-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.17-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.11-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.50-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 2.0.1-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 13.4.0-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-26.Final_redhat_00025.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.8-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.4.0-2.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.86-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +7 | 2.5.5-22.SP12_redhat_00012.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-resteasy +18 | 3.15.5-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.33.0-2.SP1_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.23-1.SP2_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.14-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.10-6.GA_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.1.16-1.Final_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.10-6.GA_redhat_00002.1.el8eap | RHSA-2023:1514, RHSA-2023:1513 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | hsqldb | 2.2.9-5.3.1 | SUSE-SU-2022:3864-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | hsqldb | 2.3.3-150000.7.3.1 | SUSE-SU-2022:3823-1 |
| openSUSE Leap 15.3 | hsqldb | 2.3.3-150000.7.3.1 | SUSE-SU-2022:3823-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | hsqldb +3 | 1:1.8.1.3-15.amzn2.0.1 | ALAS2-2023-1914 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | hsqldb +3 | 1:1.8.1.3-15.el7_9 | ELSA-2022-8560 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
mbadanoiu/CVE-2022-41853 ★ 2 · Nov 24, 2023
Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hsqldb:hsqldb | < 2.7.1 | 2.7.1 | GHSA-77xx-rxvh-q682 |
Advisories 19
- RHSA-2024:10208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:1514 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:8560 Red Hat Security Advisory: hsqldb security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:8559 Red Hat Security Advisory: hsqldb security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- DSA-5313-1 hsqldb - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3234-1 hsqldb - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:3864-1 Security update for hsqldb SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3823-1 Security update for hsqldb SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-2135 Red Hat Enterprise Linux: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 24, 2024
- WID-SEC-2024-0896 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-0578 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 15, 2023
- ALAS2-2023-1914 Important: hsqldb security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 20, 2023
- WID-SEC-2022-2232 IBM InfoSphere Information Server: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Dec 5, 2022
- ELSA-2022-8560 Important: hsqldb security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 22, 2022