7.7

CVE-2022-25647: Deserialization of Untrusted Data

Modified
AliasesMGASA-2022-0340SUSE-SU-2022:2044-1SUSE-SU-2022:3706-1
Published 01-05-2022Last modified 27-05-2026

Vulnerability summary

CVE-2022-25647 is a high (CVSS 7.7) Deserialization of Untrusted Data vulnerability in debian debian_linux. EPSS estimates a 12.23% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 12% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.7/10
010
High · v3.1 (CVE.org)
EPSS score
12.23%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 2
RHSA-2022:5892RHSA-2022:5893RHSA-2022:5894RHSA-2023:3299RHSA-2025:4226RHSA-2025:4437

Timeline

  1. 01-05-2022
    PublishedVulnerability first disclosed.
  2. 27-05-2026
    Last modifiedVulnerability information updated.

Description

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

12.23%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard87 products
  • eco-java-gradle-3.1All versions (No fix recorded)
  • eco-java-gradle-3.2All versions (No fix recorded)
  • eco-java-gradle-3.2.1All versions (No fix recorded)
  • eco-java-gradle-3.3All versions (No fix recorded)
  • eco-java-gradle-3.4All versions (No fix recorded)
Suse14 products
  • google-gson&distro=SUSE Enterprise Storage 7< 2.8.9-150200.3.6.3
  • google-gson&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 2.8.9-150200.3.6.3
  • google-gson&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.8.9-150200.3.6.3
  • google-gson&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 2.8.9-150200.3.6.3
  • google-gson&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 2.8.9-150200.3.6.3
Alpine4 products
  • openjdk11< 11.0.17_p8-r0 | < 11.0.16_p8-r0
  • openjdk13< 13.0.12_p4-r0
  • openjdk15< 15.0.8_p4-r0
  • openjdk17< 17.0.4_p8-r0
Oracle3 products
Debian2 products
  • libgoogle-gson-java< 2.8.6-1+deb11u1 | < 2.4-1+deb9u1 | < 2.8.5-3+deb10u1 | < 2.9.0-1
  • debian_linuxEOL9.0 | 10.0 | 11.0
Opensuse2 products
  • google-gson&distro=openSUSE Leap 15.3< 2.8.9-150200.3.6.3
  • google-gson&distro=openSUSE Leap 15.4< 2.8.9-150200.3.6.3
Com.google.code.gson1 product
  • gson< 2.8.9
Google1 product
  • gson≥ 2.2.3, < 2.8.9
Mageia1 product
  • google-gson< 2.8.6-1.1.mga8
Netapp1 product
Ubuntu1 product
  • libgoogle-gson-java< 2.4-1ubuntu0.1~esm1 | < 2.8.5-3~18.04.1~esm1 | < 2.8.5-3+deb10u1build0.20.04.1 | < 2.8.8-1ubuntu0.1
Wolfi1 product
  • trino< 439-r0

12 vendors · 118 products

References

25 links
Show all 25 references