CVE-2016-6814

CVE-2016-6814 is a critical-severity vulnerability in Apache Groovy with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 17% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-502.

Key facts

Description

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

Frequently asked questions

What is CVE-2016-6814?
When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
How severe is CVE-2016-6814?
CVE-2016-6814 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-6814 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 17% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-6814?
CVE-2016-6814 primarily affects Apache Groovy. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2016-6814?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2016-6814 published?
CVE-2016-6814 was published on 2018-01-18 and last updated on 2026-06-17.

References

Affected products (2)

More vulnerabilities in Apache Groovy

All CVEs affecting Apache Groovy →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →