CVE-2026-107726

A flaw was found in Hazelcast. Improper validation of client-supplied data allows a connected client to corrupt memory, potentially leading to arbitrary code execution on cluster members. Additionally, an attacker can exploit this vulnerability to read sensitive memory contents from cluster nodes or crash them, resulting in a denial of service (DoS).

This vulnerability is rated as Important severity for Red Hat products because an attacker with network connectivity to a cluster member can remotely access process memory, crash cluster instances, or potentially execute arbitrary code without requiring elevated privileges. Any compromised application or client permitted to connect to the cluster communication port can exploit this input handling flaw to disclose sensitive heap data or trigger cluster-wide denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.