Back

CVE-2016-6814

CRITICAL

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

Published: Jan 18, 2018 Modified: Jun 17, 2026
CWE-502

CVSS Metrics

CVSSv3
Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (3)

Vendor Product Version
apache groovy * ≥ 1.7.0
apache groovy * ≥ 2.4.4
redhat enterprise_linux_server 7.0

GitHub Security Advisory GHSA-xphj-m9cc-8fmq

Deserialization of Untrusted Data in Groovy

maven org.codehaus.groovy:groovy >= 1.7.0, <= 2.4.7 Fixed: 2.4.8
maven org.codehaus.groovy:groovy-all >= 1.7.0, <= 2.4.7 Fixed: 2.4.8

References (32)

Risk Scores

CVSS Score 9.8 / 10
EPSS Score 17.24%

Top 3% most likely to be exploited

Threat Score 44.4 / 100

Data Sources

NVD EPSS GitHub