WaratekVRT Sign in

CVE-2022-25647 google gson

Affected softwaregoogle gson
Severity7.7 High CVSS 3.1 3 scores
Fixed in2.8.9
WeaknessDeserialization of untrusted data (CWE-502)
Published1 May 2022
Updated13 Nov 2026

Description

The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 12% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR marshal deserialization dos rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR marshal deserialization dos rule

google.com www.google.com http://google.com

How to mitigate CVE-2022-25647

Upgrade google gson to 2.8.9 or later. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.7 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.7 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H report@snyk.io Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2025 ↗ CPU 2025-Q4 Oracle Siebel CRM / Keyword Automation (Spring Framework) (Prior to 25.8)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Analytics / Installation (Google Gson) (6.4.0.0.0, 7.0.0.0.0)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Enterprise Manager / Load Testing for Web Apps (Google Gson) (13.3.0.1)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / Framework (Google Gson) (6.4.0.0.0, 12.2.1.4.0)
Oracle Fusion Middleware / General (Google Gson) (12.2.1.4.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Blockchain Platform / BCS Console (Google Gson) (Prior to 21.1.3)
Oracle Financial Services Applications / Core (Google Gson) (14.0-14.3, 14.5-14.7)
Oracle Financial Services Applications / IDM - Authentication (Google Gson) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2)
Oracle Financial Services Applications / Infra Code (Google Gson) (14.5, 14.6, 14.7)
Oracle Financial Services Applications / Infrastructure (Google Gson) (14.0-14.3, 14.5-14.7)
Oracle Financial Services Applications / Infrastructure (Google Gson) (14.5, 14.6, 14.7)
Oracle Financial Services Applications / Infrastructure (Google Gson) (14.5, 14.6, 14.7)
Oracle Financial Services Applications / UI General (Google Gson) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Communications / ATS Framework (Google Gson) (22.2.2, 22.3.1, 22.4.0)
Oracle Communications / Install/Upgrade (Google Gson) (22.2.0)
Oracle Communications / Management (Google Gson) (10.4.0.4.1)
Oracle Communications Applications / REST API (Google Gson) (7.4.0, 7.4.1, 7.4.2, 7.5.0)
Oracle Enterprise Manager / Application Config Console (Google Gson) (13.4.0.0, 13.5.0.0)
Oracle Fusion Middleware / Majel Mobile Service (Google Gson) (5.9.0.0.0, 6.4.0.0.0)
Oracle Fusion Middleware / Samples (Google GSON) (12.2.1.4.0, 14.1.1.0.0)
Oracle GoldenGate / GoldenGate Stream Analytics (Google Gson) (Prior to 19.1.0.0.8)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / Installer (Google Gson) (22.2.0)
Oracle Communications / Platform (Google Gson) (7.2.0, 7.2.1)
Oracle Communications / Signaling (Google Gson) (22.3.0)
Oracle Communications / Signaling (Google Gson) (22.3.0)
Oracle Financial Services Applications / Installer & Configuration (Google Gson) (8.0.8.0, 8.1.0.0, 8.1.1.0)
Oracle Financial Services Applications / Security (Google Gson) (2.9.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (Google Gson) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Security (Google Gson) (5.9.0.0, 6.4.0.0.0, 12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Thirdparty Patch (Google Gson) (12.2.1.3.0, 12.2.1.4.0)
Oracle HealthCare Applications / Install (Google Gson) (8.1.1, 8.1.2, 8.1.3)
Oracle HealthCare Applications / Master Index (Google Gson) (5.0.0-5.0.3)
Oracle Insurance Applications / Development Tools (Google Gson) (12.6-12.7)
Oracle PeopleSoft / Elastic Search (Google Gson) (8.58, 8.59, 8.60)
Oracle Retail Applications / Installation (Google Gson) (20.0.1, 21.0.0)
Oracle Retail Applications / Security (Google Gson) (17.0, 18.0, 19.0)
Oracle Siebel CRM / DISA (Google Gson) (22.8 and prior)
Oracle Siebel CRM / Keyword Automation (Google Gson) (22.8 and prior)
Oracle Utilities Applications / Tools (Google Gson) (6.0.0.1.3, 6.0.0.2.4, 6.0.0.3.3)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Financial Services Applications / Studio (Google GSON) (8.0.8.2.0, 8.0.8.3.0)
Oracle Java SE / Native Image (Gson) (Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2, 22.1.0)
Oracle Retail Applications / System Administration (Google GSON) (18.0, 19.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Framework (Google Gson) 6.4.0.0.0, 12.2.1.4.0 6.4.0.0.0 · 12.2.1.4.0
Oracle Analytics Installation (Google Gson) 6.4.0.0.0, 7.0.0.0.0 6.4.0.0.0 · 7.0.0.0.0
Oracle Blockchain Platform BCS Console (Google Gson) Prior to 21.1.3
Oracle Communications ATS Framework (Google Gson) 22.2.2, 22.3.1, 22.4.0 22.2.2 · 22.3.1 · 22.4.0
Oracle Communications Install/Upgrade (Google Gson) 22.2.0 22.2.0
Oracle Communications Installer (Google Gson) 22.2.0 22.2.0
Oracle Communications Management (Google Gson) 10.4.0.4.1 10.4.0.4.1
Oracle Communications Platform (Google Gson) 7.2.0, 7.2.1 7.2.0 · 7.2.1
Oracle Communications Signaling (Google Gson) 22.3.0 22.3.0
Oracle Communications Applications REST API (Google Gson) 7.4.0, 7.4.1, 7.4.2, 7.5.0 7.4.0 · 7.4.1 · 7.4.2 · 7.5.0
Oracle Enterprise Manager Application Config Console (Google Gson) 13.4.0.0, 13.5.0.0 13.4.0.0 · 13.5.0.0
Oracle Enterprise Manager Load Testing for Web Apps (Google Gson) 13.3.0.1 13.3.0.1
Oracle Financial Services Applications Core (Google Gson) 14.0-14.3, 14.5-14.7
Oracle Financial Services Applications IDM - Authentication (Google Gson) 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2
Oracle Financial Services Applications Infra Code (Google Gson) 14.5, 14.6, 14.7 14.5 · 14.6 · 14.7
Oracle Financial Services Applications Infrastructure (Google Gson) 14.0-14.3, 14.5-14.7 14.5 · 14.6 · 14.7
Oracle Financial Services Applications Installer & Configuration (Google Gson) 8.0.8.0, 8.1.0.0, 8.1.1.0 8.0.8.0 · 8.1.0.0 · 8.1.1.0
Oracle Financial Services Applications Security (Google Gson) 2.9.0 2.9.0
Oracle Financial Services Applications Studio (Google GSON) 8.0.8.2.0, 8.0.8.3.0 8.0.8.2.0 · 8.0.8.3.0
Oracle Financial Services Applications UI General (Google Gson) 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2
Oracle Fusion Middleware General (Google Gson) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Majel Mobile Service (Google Gson) 5.9.0.0.0, 6.4.0.0.0 5.9.0.0.0 · 6.4.0.0.0
Oracle Fusion Middleware Runtime Java agent for ODI (Google Gson) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Samples (Google GSON) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Security (Google Gson) 5.9.0.0, 6.4.0.0.0, 12.2.1.3.0, 12.2.1.4.0 5.9.0.0 · 6.4.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Thirdparty Patch (Google Gson) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle GoldenGate GoldenGate Stream Analytics (Google Gson) Prior to 19.1.0.0.8
Oracle HealthCare Applications Install (Google Gson) 8.1.1, 8.1.2, 8.1.3 8.1.1 · 8.1.2 · 8.1.3
Oracle HealthCare Applications Master Index (Google Gson) 5.0.0-5.0.3
Oracle Insurance Applications Development Tools (Google Gson) 12.6-12.7
Oracle Java SE Native Image (Gson) Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2, 22.1.0 20.3.6.0 · 21.3.2.0 · 22.1.0.0
Oracle PeopleSoft Elastic Search (Google Gson) 8.58, 8.59, 8.60 8.58 · 8.59 · 8.60
Oracle Retail Applications Installation (Google Gson) 20.0.1, 21.0.0 20.0.1 · 21.0.0
Oracle Retail Applications Security (Google Gson) 17.0, 18.0, 19.0 17.0 · 18.0 · 19.0
Oracle Retail Applications System Administration (Google GSON) 18.0, 19.1 18.0 · 19.1
Oracle Siebel CRM DISA (Google Gson) 22.8 and prior
Oracle Siebel CRM Keyword Automation (Google Gson) 22.8 and prior
Oracle Siebel CRM Keyword Automation (Spring Framework) Prior to 25.8
Oracle Utilities Applications Tools (Google Gson) 6.0.0.1.3, 6.0.0.2.4, 6.0.0.3.3 6.0.0.1.3 · 6.0.0.2.4 · 6.0.0.3.3

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.google.code.gson:gson 0 2.8.9 unbounded

Products and versions

7 products, 13 version entries
SourceVendorProductSchemeAffected versions
osv com.google.code.gson gson generic ＜ 2.8.9
nvd debian debian linux generic 9.0 · 10.0 · 11.0
nvd google gson generic ≥ 2.2.3 and ＜ 2.8.9
nvd netapp active iq unified manager generic any version
nvd oracle financial services crime and compliance management studio generic 8.0.8.2.0 · 8.0.8.3.0
nvd oracle graalvm javase 20.3.6 · 21.3.2 · 22.1.0
nvd oracle retail order broker generic 18.0 · 19.1

References

URLTags
https://access.redhat.com/errata/RHSA-2022:5894 ADVISORY, RHSA-2022:5894
https://access.redhat.com/security/cve/CVE-2022-25647 REPORT, RHSA-2022:5894
https://github.com/google/gson/pull/1991 WEB
https://github.com/google/gson/pull/1991/commits WEB
https://github.com/google/gson PACKAGE
https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html WEB
https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html WEB
https://security.netapp.com/advisory/ntap-20220901-0009 WEB
https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327 WEB
https://www.debian.org/security/2022/dsa-5227 WEB

Timeline
Published2022-05-01By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.