Security readout for executives and security teams
Plain-English summary
This issue is dangerous only when a Scala-based JVM application deserializes attacker-controlled Java objects. The vulnerable Scala 2.13.x JAR can become part of a gadget chain that may cause file deletion, network activity, or possible code execution. The sources do not show active exploitation.
Executive priority
Treat as urgent for Scala services that deserialize untrusted Java objects. For other Scala deployments, prioritize inventory and upgrade planning, because the severity is high but exploitability depends on application behavior.
Technical view
CVE-2022-36944 is a CWE-502 Java deserialization gadget chain in Scala 2.13.x before 2.13.9. It is not independently exploitable; risk depends on application-level Java object deserialization with vulnerable Scala artifacts present. Reported outcomes include arbitrary file content erasure, network connections, or possible Function0 execution.
Likely exposure
Most relevant to JVM services using Scala 2.13.x before 2.13.9 and Java object deserialization. Exposure is materially lower when Java deserialization is absent, unreachable, or not attacker-controlled.
Exploitation context
The provided sources state the chain cannot be exploited alone. KEV is false, and the bundle does not cite active exploitation. Exploitation would require a reachable deserialization path in an application using the vulnerable Scala JAR.
Researcher notes
Focus validation on classpath presence plus reachable deserialization, not version presence alone. The CVE’s impact statement is conditional; avoid asserting compromise paths without evidence of application deserialization.
Mitigation direction
- Upgrade Scala 2.13.x dependencies to 2.13.9 or later where supported.
- Check OS and vendor package guidance, including Fedora advisories where applicable.
- Remove or disable Java object deserialization of untrusted data where feasible.
- Review transitive dependencies to ensure vulnerable Scala artifacts are not packaged.
- If upgrade timing is constrained, seek vendor-specific compensating controls.
Validation and detection
- Inventory applications and containers for Scala 2.13.x before 2.13.9.
- Identify any Java object deserialization entry points in exposed services.
- Confirm whether untrusted input can reach deserialization code paths.
- Verify packaged artifacts after builds, not only source dependency declarations.
- Record vendor advisory status and upgrade evidence for affected systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-36944 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.scala-lang.org/download/CVE reference
- https://github.com/scala/scala/pull/10118CVE reference
- FEDORA-2022-34acf878fbCVE reference · vendor-advisory
- FEDORA-2022-07dd9375b2CVE reference · vendor-advisory
- https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2CVE reference
- https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.