CVE-2022-45047: apache software foundation apache mina sshd Deserialization of Untrusted Data
Vulnerability summary
CVE-2022-45047 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache mina sshd. EPSS estimates a 3.79% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 1Timeline
- 16-11-2022PublishedVulnerability first disclosed.
- 01-05-2026Last modifiedVulnerability information updated.
Description
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.79%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.03 pp
From 3.82% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.apache.sshd2 products
- sshd-common< 2.9.2
- sshd-core< 2.9.2
Apache1 product
- sshd≤ 2.9.1
Apache software foundation1 product
- apache mina sshd≥ unspecified, ≤ 2.9.1
Chainguard1 product
- hadoop-fips-3.3.6All versions (No fix recorded)
Opensuse1 product
- apache-sshd&distro=openSUSE Tumbleweed< 2.9.2-1.1
5 vendors · 6 products
References
10 links
- github.com/apache/mina-sshdPACKAGE