CVE-2022-25647 Deserialization of Untrusted Data

High 7.7 Published 1 May 2022 Updated 27 May 2026

Attackers can cause denial of service in applications using Gson by exploiting unsafe deserialization in internal classes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-25647?

CVE-2022-25647 is a high-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 1 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Weakness: CWE-502

Which versions are affected by CVE-2022-25647?

2 open source packages ship an affected version, including com.google.code.gson:gson. It affects 6 products.

Package	Affected	Fixed in
`com.google.code.gson:gson` Maven	All versions	`2.8.9`
`com.google.code.gson:gson` Maven	All versions	`2.8.9`

Linux distribution packages (16)

`google-gson` SUSE:Enterprise Storage 7	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise Module for Development Tools 15 SP3	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise Module for Development Tools 15 SP4	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise Server 15 SP2-BCL	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Manager Proxy 4.1	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Manager Retail Branch Server 4.1	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Manager Server 4.1	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Manager Server Module 4.1	All versions	`2.8.9-150200.3.7.1`
`google-gson` SUSE:Manager Server Module 4.2	All versions	`2.8.9-150200.3.6.3`
`google-gson` SUSE:Manager Server Module 4.3	All versions	`2.8.9-150200.3.6.3`
`google-gson` openSUSE:Leap 15.3	All versions	`2.8.9-150200.3.6.3`
`google-gson` openSUSE:Leap 15.4	All versions	`2.8.9-150200.3.6.3`

Products include Debian Debian Linux, Google Gson, Netapp Active Iq Unified Manager, Oracle Financial Services Crime and Compliance Management Studio, Oracle Graalvm, Oracle Retail Order Broker.

How do I fix CVE-2022-25647?

Upgrade com.google.code.gson:gson to 2.8.9 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-25647 being exploited?

There is no known exploitation of CVE-2022-25647 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as CLEANSTART-2026-CW52413, CLEANSTART-2026-HP73429, CLSA-2026-1772669614, CLSA-2026-1787036800, CLSA-2026-1793128689, DEBIAN-CVE-2022-25647 and 13 more.