Critical Hazelcast Flaw Allows Arbitrary Memory Reads and Remote Code Execution

Hazelcast has released patches for a critical vulnerability, identified as CVE-2026-107726, that allows malicious clients to read arbitrary memory and potentially execute code on cluster members. The flaw stems from improper validation of data supplied by clients connected to the cluster, affecting both slim and full distributions of the platform.

According to the National Vulnerability Database, the issue receives a CVSS score of 9.3, categorizing it as critical. The vulnerability enables an attacker to read data from a cluster member’s Java heap, off-heap data, and the JVM process address space. Beyond data exfiltration, the same flaw can cause cluster members to crash. In specific configurations of Hazelcast Enterprise Edition, the memory corruption associated with this issue may lead to arbitrary code execution.

Context and Background

The vulnerability affects the unified real-time data platform, which combines stream processing with a fast data store. GitHub’s advisory service, GHSA-6v25-8wq6-xq4j, classifies the severity as critical. The advisory notes that a low-privileged malicious client can exploit this flaw to access memory from any cluster member. This access includes sensitive areas such as Java heap memory and the JVM process address space.

The weakness is mapped to CWE-20, which denotes improper input validation. Both the Hazelcast Enterprise Edition and the Community Edition are affected by this issue. The advisory explicitly states that both slim and full distributions contain the flaw, meaning the installation type does not mitigate the risk.

Who Is Affected

The vulnerability impacts specific version ranges of the com.hazelcast:hazelcast Maven package. Users running versions prior to 5.4.5 are vulnerable. Similarly, users on versions 5.5.0 up to, but not including, 5.5.10 are affected. The issue also exists in versions 5.6.0 up to, but not including, 5.6.1.

Hazelcast has provided fixed versions for both editions. Community Edition users should upgrade to version 5.7.0. Enterprise Edition customers can upgrade to version 5.7.0, 5.6.1, 5.5.10, or 5.4.5, depending on their current major version. Customers with extended support contracts for older versions are advised to contact Hazelcast Support directly for patch information.

What should you do?

Hazelcast recommends that all customers follow the advice in its Security Hardening guide. This includes ensuring that Hazelcast Security is enabled and that client authorization is enforced. Organizations should define an explicit allowlist for zero-config Compact serialization.

The vendor also advises avoiding the deployment of clients on internet-facing non-secure networks or non-secure hosts. Ensuring that firewall rules appropriately protect the Hazelcast cluster is another recommended step. Users should disable any features that are not in use to reduce the attack surface.

If an immediate update to a fixed version is not possible, Hazelcast suggests restricting cluster access to trusted clients only. Additionally, customers should ensure that these clients are hardened against compromise to mitigate the risk of exploitation.