CVE-2022-45047

CVE-2022-45047: Apache MINA SSHD: Java unsafe deserialization vulnerability

Vendor Apache Software Foundation

Product Apache MINA SSHD

Weakness CWE-502 · Unsafe deserialization

Published November 16, 2022

Last update May 1, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Key dates

02Disclosure timeline

November 16, 2022 CVE published

May 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-45047 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

04Related CVE

CVE-2026-27060 WordPress ARMember Premium plugin <= 7.0 - PHP Object Injection vulnerability CVE-2026-57371 WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability CVE-2026-65571 WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability CVE-2026-49770 WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability