# CVE-2023-36480 - Aerospike Java Client vulnerable to unsafe deserialization of server responses

**URL:** <https://discuss.aerospike.com/t/cve-2023-36480-aerospike-java-client-vulnerable-to-unsafe-deserialization-of-server-responses/10391>\
**Category:** Support Bulletins\
**Tags:** java, cve\
**Created:** [August 6, 2023, 9:30pm UTC](https://discuss.aerospike.com/t/cve-2023-36480-aerospike-java-client-vulnerable-to-unsafe-deserialization-of-server-responses/10391 "2023-08-06T21:30:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rbotzer](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.aerospike.com/rbotzer/32/2114_2.png) [@rbotzer](https://discuss.aerospike.com/u/rbotzer)\
**Post date:** [August 6, 2023, 9:30pm UTC](https://discuss.aerospike.com/t/cve-2023-36480-aerospike-java-client-vulnerable-to-unsafe-deserialization-of-server-responses/10391/1 "2023-08-06T21:30:37Z")

</div>

On August 4th, 2023, GitHub published [CVE-2023-36480](https://nvd.nist.gov/vuln/detail/CVE-2023-36480), a high severity vulnerability in our Aerospike Java client. GitHub Security Lab had previously notified us that the client is vulnerable to [CWE-502](https://cwe.mitre.org/data/definitions/502.html). Upon confirming a fix in the latest Aerospike Java client version 7.0.0, the CVE was published.

We are providing updates through our support portal’s knowledge base. Please read [CVE-2023-36480 - Aerospike Java Client vulnerable to unsafe deserialization of server responses](https://support.aerospike.com/s/article/CVE-2023-36480-Aerospike-Java-Client-vulnerable-to-unsafe-deserialization-of-server-responses).

---

<div class="post-metadata">

**Author:** ![rbotzer](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.aerospike.com/rbotzer/32/2114_2.png) [@rbotzer](https://discuss.aerospike.com/u/rbotzer)\
**Post date:** [August 8, 2023, 2:30am UTC](https://discuss.aerospike.com/t/cve-2023-36480-aerospike-java-client-vulnerable-to-unsafe-deserialization-of-server-responses/10391/2 "2023-08-08T02:30:49Z")

</div>

The following new releases of the Aerospike Java client, tools and applications provide a fix for this CVE. Please upgrade your software accordingly.

- Java Client [6.2.0](https://download.aerospike.com/download/client/java/notes.html#6.2.0)
- Java Client [5.2.0](https://download.aerospike.com/download/client/java/notes.html#5.2.0)
- Java Client [4.5.0](https://download.aerospike.com/download/client/java/notes.html#4.5.0)
- REST Gateway [2.1.2](https://download.aerospike.com/download/gateway/rest/notes.html#2.1.2)
- Aerospike Loader [4.0.1](https://github.com/aerospike/aerospike-loader/releases/tag/4.0.1)