{"action":"Upgrade org.graylog2:graylog2-server to 5.1.11 (5.1.x) or 5.2.4 (5.2.x) or later.","affected":[{"fixed":"5.1.11","introduced":"2.0.0"},{"fixed":"5.2.4","introduced":"5.2.0-alpha.1"}],"component":"org.graylog2:graylog2-server","cve_ids":["CVE-2024-24824"],"ecosystem":"Maven","epss":0.34739,"exploited":false,"fixed_versions":["5.1.11","5.2.4"],"ghsa_id":"GHSA-p6gg-5hf4-4rgj","id":"tcs_01M5N96P7AZJ8WNDJEDNRMET9H","modified_at":"2026-09-10T03:50:06.518992570Z","published_at":"2024-02-07T18:23:43Z","references":["https://osv.dev/vulnerability/GHSA-p6gg-5hf4-4rgj","https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj","https://nvd.nist.gov/vuln/detail/CVE-2024-24824","https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8","https://github.com/Graylog2/graylog2-server/commit/7f8ef7fa8edf493106d5ef6f777d4da02c5194d9","https://github.com/Graylog2/graylog2-server","https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-p6gg-5hf4-4rgj","url":"https://osv.dev/vulnerability/GHSA-p6gg-5hf4-4rgj"}],"summary":"Graylog vulnerable to instantiation of arbitrary classes triggered by API request"}