{"id":"CVE-2022-35912","details":"In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used), data binding allows a remote attacker to execute code by gaining access to the class loader.","aliases":["GHSA-6rh6-x8ww-9h97"],"modified":"2026-08-18T14:36:41.567360Z","published":"2022-07-19T15:56:59Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35912.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35912.json"},{"type":"ADVISORY","url":"https://github.com/grails/grails-core/security/advisories/GHSA-6rh6-x8ww-9h97"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35912"},{"type":"REPORT","url":"https://github.com/grails/grails-core/issues/12626"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/07/20/4"},{"type":"ARTICLE","url":"https://grails.org/blog/2022-07-18-rce-vulnerability.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/grails-core","events":[{"introduced":"0"},{"fixed":"b062a5cfe95835ea43217561db5ab8fa34aefe2b"},{"fixed":"1e3c7077e0c773bd6f20f6f73d332e890abc0c50"},{"fixed":"2279cc53db82674fc3bf527b4c9a8a071ffd7942"},{"introduced":"0481c70c7e9514dc4201e20f7fa3f21818cad34b"},{"fixed":"67287d711e65eb5a985e8efcaa54bd5cf723d025"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.3.15"},{"introduced":"4.x"},{"fixed":"4.1.1"},{"introduced":"5.x"},{"fixed":"5.1.9"},{"introduced":"5.2.x"},{"fixed":"5.2.1"}],"source":"DESCRIPTION"}}],"versions":["v5.1.8","v5.2.0","v4.1.0","v5.1.7","v5.1.6","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","archive/master","v4.0.13","v5.0.1","v5.0.0","v5.0.0-RC4","v5.0.0-RC3","v5.0.0.RC2","v4.0.12","v5.0.0.RC1","v5.0.0.M2","v3.3.14","v3.3.13","v4.0.11","v4.0.10","v4.0.9","v4.0.8","v3.3.11","v4.0.7","v5.0.0.M1","v4.1.0.M5","v4.1.0.M4","v4.1.0.M3","v3.3.12","v4.0.6","v4.0.5","v4.1.0.M2","v4.0.4","v4.1.0.M1","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v4.0.0.RC2","v3.3.10","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","v3.3.9","v3.3.8","v3.3.7","v3.3.6","v3.3.5","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.3.0.RC1","v3.3.0.M2","v3.3.0.M1","v3.2.0.RC1","v3.2.0.M2","v3.2.0.M1","v3.1.0.RC2","v3.1.0.RC1","v3.1.0.M3","v3.1.0.M2","v3.1.0.M1","v3.0.1","v3.0.0","v3.0.0.RC3","v3.0.0.RC2","v3.0.0.RC1","v3.0.0.M2","v3.0.0.M1","v2.4.0.RC2","v2.4.0.RC1","v2.4.0.M2","v2.4.0.M1","v2.3.0","v2.3.0.RC2","v2.3.0.RC1","v2.3.0.M2","v2.3.0.M1","v2.2.0.RC1","v2.1.0.RC1","v2.0.0.RC1","v2.0.0.M2","v2.0.0.M1","v1.4.0.M1","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3","v1.2","v1.1.1","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0","v1.0.RC4","v1.0.RC3","v1.0.RC2","v1.0.RC1","v0.6","v0.6.RC1","v0.5.6","v0.5.5","v0.5.5.RC1","v0.5","v0.5.RC2","v0.5.RC1","v0.4.2","v0.4.1","v0.4","v0.3","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35912.json","vanir_signatures_modified":"2026-08-18T14:36:41Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/1e3c7077e0c773bd6f20f6f73d332e890abc0c50","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133658545622022813691893546492822193591","231968117220509831045687927920220568529","322518850141335907120383407016704122099","68221056247180651435663117672102194603"]},"id":"CVE-2022-35912-07f35209"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/b062a5cfe95835ea43217561db5ab8fa34aefe2b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"86599955727034140749407227730922538923","length":89},"id":"CVE-2022-35912-0fc45d9e"},{"deprecated":false,"digest":{"line_hashes":["265527345752929269959675063536228266316","253657430198469265743706077559009248439","235959779190895364226641945778270050068","317079240568775686040492947509911246572"],"threshold":0.9},"id":"CVE-2022-35912-25a5f26e","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/2279cc53db82674fc3bf527b4c9a8a071ffd7942","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"}},{"signature_version":"v1","source":"https://github.com/apache/grails-core/commit/67287d711e65eb5a985e8efcaa54bd5cf723d025","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"72789526643964925550660745788881438065","length":82},"id":"CVE-2022-35912-3b3eac30","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/apache/grails-core/commit/67287d711e65eb5a985e8efcaa54bd5cf723d025","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["307928916851332549997533942989132310619","323334065841210056306062102315409373746","227454999501251086902559425553658170348","141832622888151308408797725857103777105"],"threshold":0.9},"id":"CVE-2022-35912-9b891d0d","signature_type":"Line"},{"target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"},"deprecated":false,"digest":{"function_hash":"337336054825846849060651794846366540003","length":82},"id":"CVE-2022-35912-a40096a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/1e3c7077e0c773bd6f20f6f73d332e890abc0c50"},{"deprecated":false,"digest":{"line_hashes":["168448992433160026276914504092498461111","212024600673281245820970122453290818013","24168885317386346339111550118646531829","57181071602607972446226234243744107833"],"threshold":0.9},"id":"CVE-2022-35912-e8f2e693","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/b062a5cfe95835ea43217561db5ab8fa34aefe2b","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java"}},{"deprecated":false,"digest":{"function_hash":"294856197498714873664731451451100738900","length":82},"id":"CVE-2022-35912-fb932cdf","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/grails-core/commit/2279cc53db82674fc3bf527b4c9a8a071ffd7942","target":{"file":"grails-core/src/test/groovy/grails/util/GrailsUtilTests.java","function":"testGrailsVersion"}}]}}],"schema_version":"1.9.0"}