Hazelcast 5.3 end of life
Hazelcast Platform 5.3 left standard support on 19 May 2025, and its extended support ends on 19 November 2026. Extended support gives guidance but no patch releases, and the last 5.3 release is 5.3.8, from 17 July 2024. Upgrade to 5.7, in standard support to 13 May 2028, or keep 5.3 patched with OSSeva.
What now
Which vendors provide Hazelcast 5.3 security patches after 19 November 2026?
Hazelcast extended support- End of life
- 19 November 2026
- Released
- May 2023
- Final release
- 5.3.8 (17 July 2024)
- Successor
- Hazelcast Platform 5.7 (standard support to 13 May 2028)
Date published by Hazelcast Version Support Windows. We do not publish a lifecycle date we cannot source. Dates checked against Hazelcast's Version Support Windows article on 9 November 2026.
Last reviewed
Hazelcast versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Hazelcast 5.3 (this page) | 19 May 2023 | 19 November 2026 | Approaching |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 19 November 2026
- Hazelcast's extended support for 5.3 ends on 19 November 2026. Extended support is assistance, guidance and recommendations. After that date the published policy gives 5.3 no Hazelcast support of any kind, although a customer's own agreement can differ.
- Patch releases are not part of extended support, and none are committed for 5.3 now. Standard support, the period with patch releases at Hazelcast's discretion, ended on 19 May 2025. A CVE disclosed against 5.3 from here has no committed Hazelcast fix.
- The 5.3 line already went quiet. Hazelcast's 5.3 documentation lists no release after 5.3.8, published on 17 July 2024, ten months before standard support ended.
What actually breaks in the upgrade
5.7 is the target, not 5.4 or 5.5
5.4 left standard support on 16 April 2026 and 5.5 on 30 July 2026, so both are already in extended support. 5.6 runs to 15 October 2027 and 5.7 to 13 May 2028. Moving 5.3 to 5.5 would buy a few months and repeat this exercise.
Rolling upgrades go one minor at a time
Hazelcast's documentation lists a rolling upgrade to the next minor version, or a new patch of the same minor, and marks it Enterprise Edition only. From 5.3 to 5.7 that is four steps: 5.4, 5.5, 5.6, 5.7. A Community Edition cluster has no rolling path, so plan for an outage, and rehearse any jump larger than one minor on a copy of the cluster first.
The Java baseline moves
5.3 supports JDK 11 and 17, and no longer supports JDK 8. 5.7.2 lists JDK 17, 21 and 25, and Hazelcast's upgrade page says 5.5 and later support JDK 17 or later only. A cluster on JDK 11 changes its JVM before or during the move.
Hazelcast Platform support windows
Hazelcast supports each minor release for two years with patch releases at its discretion, then for 18 months of extended support that gives assistance but no patch releases. Platform 5.3 is the next line to finish extended support, on 19 November 2026. Platform 5.7 has the longest runway: standard support to 13 May 2028.
Hazelcast Platform support windows
| Version | Released | End of standard support | End of extended support |
|---|---|---|---|
| 5.7 | 13 May 2026 | 13 May 2028 | 13 Nov 2029 |
| 5.6 | 15 Oct 2025 | 15 Oct 2027 | 15 Apr 2029 |
| 5.5 | 30 Jul 2024 | 30 Jul 2026 | 30 Jan 2028 |
| 5.4 | 16 Apr 2024 | 16 Apr 2026 | 16 Oct 2027 |
| 5.3 | 19 May 2023 | 19 May 2025 | 19 Nov 2026 |
| 5.2 | 26 Oct 2022 | 26 Oct 2024 | 24 Apr 2026 |
Source: Hazelcast Version Support Windows, checked 9 November 2026. Hazelcast states that a customer's own agreement overrides this general description.
CVEs recorded for Hazelcast 5.3
Two CVEs in OSSeva's CVE directory list 5.3 as affected, and Hazelcast fixed both in 5.3.5. The last 5.3 release, 5.3.8, is outside both ranges, so no recorded advisory is open on it today. What changes is the next advisory: Hazelcast has no committed 5.3 patch for it.
Hazelcast CVEs in the OSSeva CVE directory that list 5.3
| CVE | CVSS | Published | Issue | Fixed in 5.3 |
|---|---|---|---|---|
| CVE-2023-45859 | 7.6 | 28 Feb 2024 | Hazelcast: some client protocol operations skip permission checks | 5.3.5 |
| CVE-2023-45860 | 6.5 | 16 Feb 2024 | Hazelcast: CSV File Source SQL mapping lets clients read member files | 5.3.5 |
The directory lists CVEs OSSeva has recorded for Hazelcast, so it is a subset of every advisory. CVSS is NVD's score where NVD has scored the record, otherwise the score CISA-ADP or the CNA gave it. Fixed-in versions are from Hazelcast's GitHub security advisories GHSA-xh6m-7cr7-xx66 and GHSA-8h4x-xvjp-vf99, checked 8 November 2026.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Platform 5.7 | Four minor versions up, to the line in standard support until 13 May 2028. | A JVM change for JDK 11 estates, a rehearsal, and either four rolling steps or a planned outage | Engineering time | The right destination for most clusters. |
| OSSeva patched 5.3 builds | Backported security fixes to the 5.3 line after Hazelcast's last patch. | Starts from your current version | Subscription, priced per cluster | For clusters that cannot take the upgrade before 19 November. |
| Stay unpatched | No Hazelcast support after 19 November and no 5.3 release since 17 July 2024. | None | Zero now | Hard to defend: there is no committed fix for the next advisory. |
What OSSeva does for Hazelcast 5.3
OSSeva patches this line
OSSeva patches Hazelcast Platform 5.3.x, keeping the serialization format, cluster protocol and client compatibility your applications use. Delivered as GPG-signed Maven artifacts and Docker images, on the Patch, Assure and Operate tiers, priced per cluster.
Hazelcast extended support
Hazelcast extended support What your auditor will say
Applicable security patches are expected on every system component, and a data grid that holds session state or cached credentials is one. A 5.3 cluster with no vendor patch stream needs a documented patch source or a compensating control.
Auditors ask for evidence that production systems receive security fixes. A line outside Hazelcast's support windows fails that test unless another supplier ships the fixes and can show which CVEs they close.
When does Hazelcast 5.3 reach end of life?
Hazelcast 5.3 extended support ends on 19 November 2026. Standard support, the period with patch releases, ended on 19 May 2025, two years after the 19 May 2023 release.
Is Hazelcast 5.3 still supported?
Only in extended support, which runs to 19 November 2026 and gives assistance, guidance and recommendations. After that date the published policy gives 5.3 no Hazelcast support, though a customer's own agreement can differ.
Does Hazelcast still patch 5.3?
No. The last 5.3 release in Hazelcast's documentation is 5.3.8, from 17 July 2024, and extended support includes no patch releases.
What should I upgrade Hazelcast 5.3 to?
Platform 5.7, in standard support until 13 May 2028. 5.4 and 5.5 are already past standard support, and 5.6 ends it on 15 October 2027.
What is the difference between Hazelcast standard and extended support?
Standard support lasts two years from release, and Hazelcast may issue patch releases during it. Extended support adds 18 months of assistance, guidance and recommendations, with no further patch releases.
Can I get security patches for Hazelcast 5.3 after 19 November 2026?
Not from Hazelcast. OSSeva patches 5.3.x on the Patch, Assure and Operate tiers; Critical CVEs within 48 hours and High within 7 days.
Get a quote
Still running Hazelcast 5.3?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?