CVE-2022-25647
Aliases:GHSA-4jrv-ppp4-jm57SNYK-JAVA-COMGOOGLECODEGSON-1730327DEBIAN-CVE-2022-25647CGA-365x-f88c-g4qpCGA-453x-qp5v-m88hCGA-53xh-jhh4-46wcCGA-62hv-j2ff-72v9CGA-62x4-v8wj-75vwCGA-65xq-537p-wf5rCGA-6gh6-wgvq-4vhmCGA-6r2x-3595-9p7rCGA-7242-xmjf-4gh5CGA-8w87-phg3-c32gCGA-944v-v8pf-pqfvCGA-ffm7-9fr5-qf7wCGA-fmpp-9v8f-p52mCGA-fqjf-62g2-g558CGA-gh4j-c5rm-fxprCGA-h6gc-37c6-cj48CGA-hgpx-5g6c-7g6wCGA-hpgj-748f-53p6CGA-jhj9-48w7-v39jCGA-jrmp-2q56-68q3CGA-m8jg-rr43-vwvjCGA-mgmh-5893-hpjmCGA-p2xh-9cwq-vv6wCGA-p886-fjx2-ggpvCGA-px9p-37f9-x2m9CGA-qh42-g6fr-j8w3CGA-qq6r-4j4p-v3qfCGA-r5w4-65hh-8cgxCGA-rcmc-vv2g-j37gCGA-rgvv-4w9f-6h2wCGA-v6wm-9mwr-cw9wCGA-vqmr-8qrg-2r36CGA-wgxx-8m2c-c2w3CGA-wh4q-mqvf-4g97CGA-xg65-p5fh-8v5vCGA-xp8q-m4m7-q96jCGA-xphv-w652-3mq3CGA-xpq5-3vgv-4fj2CGA-xqx9-vc53-22rmCGA-xrgv-r383-v39pCGA-22x7-qrjx-wm43CGA-2pm8-g2vq-2wr3CGA-2wp5-49h3-2x8gCGA-3672-3596-5439CGA-3vw8-p4f2-3f5fCGA-52wh-vxmc-6qm2CGA-5rv5-m3j5-wgq3CGA-6f8v-h3j5-jphhCGA-6mhq-qrc5-gprvCGA-745v-69c3-xmm7CGA-77ff-rjf7-v52fCGA-7p2f-gj74-6cgvCGA-84q6-8wh3-7wjqCGA-8h2p-rvp2-7gc4CGA-8qfg-7hp6-57hvCGA-9w28-q3v9-gqqvCGA-f7gh-7mj5-h59hCGA-f8f4-vgqv-mm6hCGA-fc36-mfhr-5fvxCGA-fhp6-v458-2688CGA-h2qj-8hqh-r4hgCGA-hwr5-8cp7-jmwcCGA-jc33-x948-v6f6CGA-mfwf-8cr4-qjcfCGA-mr7p-g7g5-4w5vCGA-p795-878x-3vx9CGA-pp22-j753-h8mpCGA-r3mr-6fvf-2h8hCGA-vrpq-m6cx-jjj4CGA-w7j5-vjpp-ccc8CGA-x2rq-3hwx-gv68CGA-xm4r-gvv2-vvp3CGA-2q9g-9m55-92vmCGA-364c-vrh5-2h7qCGA-3jrf-7495-fv5gCGA-3qq6-9fx8-fcg4CGA-3vgg-8fc5-x934CGA-45w2-rgwh-69wgCGA-5c7r-5c4f-m38fCGA-5hfr-g533-8qp2CGA-62wj-j255-6w3vCGA-633c-336r-ffm5CGA-66q4-5q38-3qp4CGA-68hv-29qv-fmvjCGA-6gj4-75q3-x6jrCGA-6rqp-ww4v-qp7hCGA-84v9-632w-j8wcCGA-85x3-q5x4-pfmxCGA-87wp-7h85-mh6vCGA-894c-2h3m-jw75CGA-8vx2-6m25-w9x8CGA-96hm-cr8j-3p7xCGA-9q9h-jrvp-g644CGA-9r5c-fhwg-7hfhCGA-c84j-x2v2-v5pmCGA-cj3g-v3mp-g5rgCGA-cj6w-rr5j-5hpmCGA-cp55-qg24-j629CGA-f63h-7c73-8q63CGA-frvw-r59r-7pj7CGA-g23f-jxr7-q3prCGA-g2m7-r852-gpc3CGA-g2x8-cg37-2hf9CGA-h2wm-vvwr-2q55CGA-hr7r-2ghf-pc2jCGA-mhqx-3rc4-5h8wCGA-mjp5-m835-gmr8CGA-p3gf-9fx6-q45rCGA-p3px-pxgp-687pCGA-p4qf-39hq-5464CGA-p5w8-h3ph-qq4wCGA-p722-p587-rrv2CGA-p98j-j486-3ff6CGA-ph82-pqmv-2vw8CGA-pq75-vxfw-g2gmCGA-q3j5-2x87-xchxCGA-q973-gxpw-67ffCGA-r66g-p349-gw2rCGA-r92h-hjp5-vhchCGA-rcgm-xpwv-q9gxCGA-rm7c-h3w4-c8v6CGA-v5p8-c9hv-47fjCGA-v6vp-p98f-rfvrCGA-v8ch-h6q7-65x7CGA-wjxg-r7rc-qc3jCGA-wx8r-8wj5-m423CGA-x3wh-m26x-834hCGA-xj9j-xh66-399gCGA-328w-xw49-mjfmCGA-3mcg-q4r2-5pjgCGA-3qpx-3vch-m7qgCGA-4chm-4652-fwp2CGA-4g6x-vgcq-jrwgCGA-4gm9-qpg6-7v9hCGA-52f9-52v5-3qh2CGA-5465-4cc4-xwcgCGA-624g-m8h8-x4c6CGA-6c86-w6c9-pgqrCGA-6g58-hjfq-c8m8CGA-6wc5-r3mf-vp6jCGA-6wrp-9m3w-58x6CGA-74w7-pp2m-m7w2CGA-7f35-r5p5-vx23CGA-7rmg-6pmh-p74cCGA-962x-xc2f-7w9gCGA-97p5-5fmg-jcfcCGA-998r-5qgr-rfcwCGA-9ph2-j4j4-hpwwCGA-c22r-j2fw-mxf7CGA-c5r7-h5c4-jjj4CGA-f8qr-hhm3-r72wCGA-fqjv-36vg-mp6pCGA-g3j8-vpr5-jw5pCGA-g4qx-3wpg-hr99CGA-g833-f9w5-9w7cCGA-gjfq-c6w3-f5cgCGA-gq69-v6rf-q79hCGA-hw5q-rjq8-6h7vCGA-mgmr-px88-mhmvCGA-mx2p-79qj-rv73CGA-mx6j-94fh-qx8pCGA-p77c-2v48-6g68CGA-ppjh-h64j-jjw5CGA-q6qh-8659-xf3jCGA-q7jq-6233-3jh9CGA-qchp-mqw5-wwmqCGA-rj29-qxvr-8q39CGA-v9gx-gppg-9wxpCGA-vxph-q7r3-7p87CGA-w5pg-4hcf-9g26CGA-wr5h-345g-xh52CGA-wx95-9rp2-wqmqCGA-xmv8-8pj6-mr2gCGA-xpjj-mh53-hrcm
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 01 May 2022, 15:30
Last modified:27 May 2026, 14:03
Vulnerability Summary
Overall Risk (default)
medium
33/100 CVSS Score
7.7 HIGH
v3.1 (cve.org)
EPSS Score
12.23% MEDIUM
12% probability +10.15%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
01 May 2022, 15:30
Published
Vulnerability first disclosed
27 May 2026, 14:03
Last Modified
Vulnerability information updated
Description
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CVSS Metrics
- v3.1•HIGH•Score: 7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS Trends
Current EPSS score: 12.23%• Percentile: 96%
Techniques & Countermeasures
- CWE-502•Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Systems
- chainguard•eco-java-gradle-3.1
all
- chainguard•eco-java-gradle-3.2
all
- chainguard•eco-java-gradle-3.2.1
all
- chainguard•eco-java-gradle-3.3
all
- chainguard•eco-java-gradle-3.4
all
- chainguard•eco-java-gradle-3.4.1
all
- chainguard•eco-java-gradle-3.5
all
- chainguard•eco-java-gradle-3.5.1
all
- chainguard•eco-java-gradle-4.0
all
- chainguard•eco-java-gradle-4.0.1
all
- chainguard•eco-java-gradle-4.0.2
all
- chainguard•eco-java-gradle-4.1
all
- chainguard•eco-java-gradle-4.10
all
- chainguard•eco-java-gradle-4.10.1
all
- chainguard•eco-java-gradle-4.10.2
all
- chainguard•eco-java-gradle-4.10.3
all
- chainguard•eco-java-gradle-4.2
all
- chainguard•eco-java-gradle-4.2.1
all
- chainguard•eco-java-gradle-4.3
all
- chainguard•eco-java-gradle-4.3.1
all
- chainguard•eco-java-gradle-4.4
all
- chainguard•eco-java-gradle-4.4.1
all
- chainguard•eco-java-gradle-4.5
all
- chainguard•eco-java-gradle-4.5.1
all
- chainguard•eco-java-gradle-4.6
all
- chainguard•eco-java-gradle-4.7
all
- chainguard•eco-java-gradle-4.8
all
- chainguard•eco-java-gradle-4.8.1
all
- chainguard•eco-java-gradle-4.9
all
- chainguard•eco-java-gradle-5.0
all
- chainguard•eco-java-gradle-5.1
all
- chainguard•eco-java-gradle-5.1.1
all
- chainguard•eco-java-gradle-5.2
all
- chainguard•eco-java-gradle-5.2.1
all
- chainguard•eco-java-gradle-5.3
all
- chainguard•eco-java-gradle-5.3.1
all
- chainguard•eco-java-gradle-5.4
all
- chainguard•eco-java-gradle-5.4.1
all
- chainguard•eco-java-gradle-5.5
all
- chainguard•eco-java-gradle-5.5.1
all
- chainguard•eco-java-gradle-5.6
all
- chainguard•eco-java-gradle-5.6.1
all
- chainguard•eco-java-gradle-5.6.2
all
- chainguard•eco-java-gradle-5.6.3
all
- chainguard•eco-java-gradle-5.6.4
all
- chainguard•eco-java-gradle-6.0
all
- chainguard•eco-java-gradle-6.0.1
all
- chainguard•eco-java-gradle-6.1
all
- chainguard•eco-java-gradle-6.1.1
all
- chainguard•eco-java-gradle-6.2
all
Showing first 50 affected entries in server-rendered view.
References (13)
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327
- https://github.com/google/gson/pull/1991
- https://github.com/google/gson/pull/1991/commits
- https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220901-0009/
- https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html
- https://www.debian.org/security/2022/dsa-5227
- https://nvd.nist.gov/vuln/detail/CVE-2022-25647
- https://github.com/google/gson
- https://security.netapp.com/advisory/ntap-20220901-0009
- https://security-tracker.debian.org/tracker/CVE-2022-25647
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25647.json