{"action":"Upgrade org.scala-lang:scala-library to 2.13.9 or later.","affected":[{"fixed":"2.13.9","introduced":"2.13.0"}],"component":"org.scala-lang:scala-library","cve_ids":["CVE-2022-36944"],"ecosystem":"Maven","epss":0.10968,"exploited":false,"fixed_versions":["2.13.9"],"ghsa_id":"GHSA-8qv5-68g4-248j","id":"tcs_01M5N8N9NAW4FD4PWVC250DV68","modified_at":"2026-09-10T03:49:45.276399316Z","published_at":"2022-09-25T00:00:20Z","references":["https://osv.dev/vulnerability/GHSA-8qv5-68g4-248j","https://nvd.nist.gov/vuln/detail/CVE-2022-36944","https://github.com/scala/scala/pull/10118","https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2","https://github.com/scala/scala","https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0","https://github.com/scala/scala/releases/tag/v2.13.9","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI","https://www.scala-lang.org/download"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8qv5-68g4-248j","url":"https://osv.dev/vulnerability/GHSA-8qv5-68g4-248j"}],"summary":"Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization"}