This maintenance release addresses security vulnerabilities across multiple dependencies, including Apache Shiro, Eclipse Jetty, Jackson, Micrometer, HttpCore5, Bouncy Castle, Reactor Core, and Log4j.

Highlights

• Apache Shiro Major Upgrade: Remediated CVE-2026-49268 by upgrading Shiro from 2.1.0 to 3.0.0 across all modules (GEODE-10607 #8033, GEODE-10591 #8017)

• Jetty Security Patches: Remediated CVE-2026-10050 by upgrading Jetty from 12.0.33 to 12.0.37 (GEODE-10605 #8031)

• Jackson Security Patches: Remediated GHSA-2m67-wjpj-xhg9 and CVE-2026-19032 by upgrading Jackson from 2.21.2 to 2.21.6 (GEODE-10589 #8015, GEODE-10621 #8048)

• Micrometer Security Patches: Remediated CVE-2026-40984 and CVE-2026-59296 by upgrading Micrometer from 1.14.0 to 1.16.7 (GEODE-10592 #8018, GEODE-10619 #8044)

• HttpCore5 Remediation: Remediated CVE-2026-54428 by upgrading HttpCore5 and HttpCore5-H2 from 5.3.6 to 5.4.3 (GEODE-10590 #8016)

• Bouncy Castle Remediation: Remediated CVE-2026-8763 in the bcprov-jdk18on transitive dependency, 1.84 to 1.85 (GEODE-10606 #8032)

• Reactor Core Remediation: Remediated CVE-2026-47857 by pinning Reactor Core, a transitive dependency of spring-shell-core, from 3.6.10 to 3.8.7 (GEODE-10622 #8049)

• Log4j Upgrade: Upgraded Log4j from 2.25.4 to 2.25.5 to address a reported advisory (GEODE-10604 #8030)

sha256 for apache-geode-2.0.3.tgz is 23dd1cbf5c6ed49909a596f0b49c0ec73f6f3c7e6fec20c07d32af3543684825

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-2.0.3

This maintenance release addresses security vulnerabilities in Log4j and Jackson dependencies.

Highlights

• Improper Encoding or Escaping of Output Remediation (CVE-2026-49844): Apache Log4j has been upgraded from 2.25.4 to 2.25.5 to address CVE-2026-49844 (CWE-116, Improper Encoding or Escaping of Output; CVSS 5.9, Medium). Log4j API versions 2.13.1 through 2.25.4 improperly encode non-finite IEEE 754 floating-point values (NaN, Infinity, -Infinity) in MapMessage.asJson(), emitting bare tokens that are not valid JSON under RFC 8259. Any layout that relies on MapMessage.asJson(), including JsonTemplateLayout, could produce corrupted log records and disrupt downstream log ingestion. The earlier fix for CVE-2026-34481 did not cover all affected code paths. All Log4j artifacts shipped with Geode move to 2.25.5: log4j-api, log4j-core, log4j-jcl, log4j-jul, and log4j-slf4j-impl.

• Jackson upgraded to 2.21.5 (CVE-2026-54513): Jackson has been upgraded from 2.21.2 to 2.21.5 to address CVE-2026-54513 (CWE-184; CVSS 8.1, High). In jackson-databind from 2.10.0 up to 2.21.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists an array type based only on clazz.isArray() without validating the array's component type against the configured allowlist. A validator configured with allowIfSubTypeIsArray() alongside an explicit concrete-type allowlist would therefore accept an array whose element type was never allowlisted, and when no per-element type IDs are present Jackson instantiates that component type directly with no further validation. The upstream fix landed in 2.21.4; Geode takes 2.21.5. The upgrade covers jackson-core, jackson-databind, jackson-datatype-joda, and jackson-datatype-jsr310. jackson-annotations remains at 2.21, which is the current release on its own versioning cadence.

sha256 for apache-geode-1.15.5.tgz is ffa5778e6a8d788c50c677efc0b42ecb1d96068033229d68c01794d0ccd2a956

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.5

This maintenance release addresses security vulnerabilities across multiple dependencies, including Log4j, Jackson, and Bouncy Castle, and HttpCore5.

Highlights

• Log Injection Remediation: Remediated CVE-2026-34478 - Improper Output Neutralization for Logs in Log4j Rfc5424Layout via CRLF injection (GEODE-10579 #8005)

• Denial of Service Remediation: Fixed Allocation of Resources Without Limits or Throttling in Jackson Core allowing oversized JSON documents to bypass document length limits (GEODE-10575 #8002, GEODE-10576 #8003)

• Critical Security Patches: Remediated CVE-2026-0636, CVE-2026-5598, and CVE-2025-14813 in Bouncy Castle transitive dependency (GEODE-10583 #8008)

• Denial-of-service (DoS) Fixes: Remediated CVE-2025-8671 in HttpCore5 and HttpCore5-H2 (GEODE-10577 #8004)

Full Changelog: rel/v2.0.1...rel/v2.0.2

This release addresses security vulnerabilities in Log4j and Jackson dependencies.

Highlights

• Log Injection Remediation: Remediated CVE-2026-34478 — Improper Output Neutralization for Logs in Log4j Rfc5424Layout via CRLF injection. Log4j Core versions 2.21.0 through 2.25.3 are vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes (CWE-117, CWE-684), affecting users of stream-based syslog services. Upgraded Log4j from 2.25.3 to 2.25.4 (GEODE-10580 #8006)
• Denial of Service Remediation: Fixed Allocation of Resources Without Limits or Throttling in Jackson Core allowing oversized JSON documents to bypass document length limits (SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551). Upgraded Jackson from 2.18.6 to 2.21.2, annotations to 2.21 (GEODE-10576 #8003)

Full Changelog: rel/v1.15.3...rel/v1.15.4

This maintenance release is dedicated to critical security remediations and essential dependency updates, ensuring the continued security and integrity of the Apache Geode platform.

Highlights

• Security Vulnerability Remediation: Resolved Allocation of Resources Without Limits or Throttling (GEODE-10567 #7991)
• Vulnerability Remediation: Addressed CVE-2025-68161 to protect against a man-in-the-middle attack (GEODE-10544 #7978)
• Security Remediation: Addressed CVE-2025-48924 in Apache Commons Lang3 (GEODE-10546 #7976)
• Dependency Update: Upgraded commons-io from 2.15.1 to 2.18.0 (GEODE-10549 #7979)
• Dependency Update: Upgraded slf4j-api from 1.7.32 to 1.7.36 (GEODE-10548 #7977)

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.3

Apache Geode version 2.0.1 focuses on critical security vulnerability remediations and dependency updates to ensure the ongoing stability and security of the platform.

Highlights

• Critical Security Patches: Remediated CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, and CVE-2026-1225 (GEODE-10555 #7982)

• Vulnerability Remediation: Addressed CVE-2025-68161 to protect against a man-in-the-middle attack (GEODE-10543 #7975)

• Security Remediation: Resolved CVE-2026-23903 to remediate Authentication Bypass (GEODE-10559 #7986)

• Denial of Service Remediation: Fixed Allocation of Resources Without Limits or Throttling (GEODE-10565 #7990)

• Security by-pass and DoS Remediation: Resolved CVE-2026-1605 and CVE-2025-11143 (GEODE-10568 #7992)

• EndpointRequest Security Fix: Remediated CVE-2025-22235 (GEODE-10572 #7993)

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-2.0.1

Apache Geode 2.0.0 – Major Modernization Highlights

• Enhanced Security – Application-level HTTP session management improvements, full Java Module System compliance, and removal of unsafe reflection usage.

• Modern Java Support – Requires Java 17 LTS for long-term stability and compatibility.

• Jakarta EE 10 Ready – Complete migration from javax.* to jakarta.*, with support for Apache Tomcat 10.1/11 and Eclipse Jetty 12.

• Updated Spring Stack – Spring Framework 6.x and Spring Security 6.x modernization.

• HTTP & CLI Improvements – Apache HttpComponents 5.x with HTTP/2 support; Spring Shell 3.x modernization for GFSH with improved command completion.

• Build System Upgrade – Gradle 7.3.3 for consistent builds and Java 17 + Jakarta EE 10 support.

See release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-2.0.0

Highlights

• New: Generational ZGC support (GEODE-7483)
• Remediation of major security vulnerabilities
• Test Coverage: New ObjectSizer-related JUnit tests expanding memory sizing validation
• Security Upgrades: Upgraded dependencies to address security vulnerabilities and deprecated APIs. Jetty, Jackson, Shiro, JGroups, Snappy, commons-beanutils, commons-logging
• Documentation Updates: Improved in-code documentation and external guides

sha256 for apache-geode-1.15.2.tgz is a20ec6873356ca930c7ff26d618807f75f240dba015fbb877017b9e6f5475ccd

See full release notes at: https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.2

This patch release includes a few bug fixes.

sha256 for apache-geode-1.15.1.tgz is 2668970982d373ef42cff5076e7073b03e82c8e2fcd7757d5799b2506e265d57

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.1

This release includes a significant number of bug fixes and improvements, including JDK17 support.

sha256 for apache-geode-1.15.0.tgz is 97cd96e94991cbd433d93e8474e1c2e65deb92f022d810a1931464017701701b

See full release notes at https://cwiki.apache.org/confluence/display/GEODE/Release+Notes#ReleaseNotes-1.15.0