CVE-2022-41853: Remote code execution in HyperSQL DataBase
Vulnerability summary
CVE-2022-41853 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 5.15% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
Not severe (CVSS 8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5Timeline
- 06-10-2022PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA8.0HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.15%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.15% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
- hsqldb< 1:1.8.0.10-13.el6_10 | < 1:1.8.1.3-15.el7_9
- hsqldb-demo< 1:1.8.0.10-13.el6_10 | < 1:1.8.1.3-15.el7_9
- hsqldb-javadoc< 1:1.8.0.10-13.el6_10 | < 1:1.8.1.3-15.el7_9
- hsqldb-manual< 1:1.8.0.10-13.el6_10 | < 1:1.8.1.3-15.el7_9
Debian2 products
- hsqldb< 2.5.1-1+deb11u1 | < 2.4.1-2+deb10u1 | < 2.7.1-1
- debian_linuxEOL10.0 | 11.0
Opensuse2 products
- hsqldb&distro=openSUSE Leap 15.3< 2.3.3-150000.7.3.1
- hsqldb&distro=openSUSE Leap 15.4< 2.3.3-150000.7.3.1
Hsqldb1 product
- hypersql_database< 2.7.1
Hypersql database1 product
- hsqldb≥ unspecified, < 2.7.1
Org.hsqldb1 product
- hsqldb< 2.7.1
Suse1 product
- hsqldb&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.2.9-5.3.1
Ubuntu1 product
- hsqldbAll versions (No fix recorded)
8 vendors · 13 products
