OSSEVA FOR GEMFIRE / GEODE

GemFire support: patched, protected, operated.

OSSeva provides GemFire support for GemFire 9.x and 10.x and Apache Geode 1.14.x through 2.x, including patched builds for GemFire 9.15 and 10.0 after Broadcom's support dates passed and for Geode 1.14.x after upstream stopped releasing it. Broadcom's GemFire pricing and support uncertainty has enterprise teams evaluating Apache Geode as the exit path. OSSeva also provides migration services to move from commercial GemFire to OSSeva-supported Geode.

Reply within 1 business day · No commitment · or book a 15-minute call

Last reviewed 29 September 2026

Trusted globally by enterprises

Why now

Broadcom GemFire: support windows are closing

Broadcom's lifecycle portal shows GemFire 9.15 support ended on 31 October 2025 and 10.0 on 30 April 2026. Estates on those lines must upgrade to 10.1 or later, move to Apache Geode, or find other cover for the version they run.

Apache Geode is the open-source foundation — but needs enterprise support

Apache Geode is the upstream open-source project that GemFire is built on. Running Geode community without CVE patching and compliance documentation creates the same audit exposure as any other EOL open-source component.

In-memory data grids hold session state and sensitive data

GemFire and Geode deployments frequently store session tokens, financial data, and healthcare records. CVEs in the serialization layer, security manager, or network topology represent direct data exposure risks with immediate compliance implications.

Versions covered

All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.

Version	JVM	Status	Patches	Active CVEs
GemFire 9.x(Full CVE coverage)	Java 8–11	Extended	Active	Clean
GemFire 10.x(Full CVE coverage)	Java 8–21 (10.0–10.2); 17+ (10.3)	Extended	Active	Clean
Geode 1.14.x(No further upstream 1.14 releases — OSSeva patched)	Java 8+	EOL	Active	Clean
Geode 1.15.x(Upstream maintained)	Java 8+	Current	Active	Clean
Geode 2.x	Java 17+	Current	Active	Clean

GemFire and Geode end of life dates for every version →

Running a GemFire / Geode version or build not listed here?

What you get

Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.

OSSeva Patch

CVE patches for GemFire and Geode. Covers both commercial and community builds.

Quarterly CVE patches for GemFire 9.x–10.x and Geode 1.x–2.x
Serialization and deserialization CVE priority coverage
Maven / Docker delivery
Signed artifacts (GPG)
CVE disclosure notifications
Architecture review
24/7 managed operations

OSSeva Assure

Patch plus cluster security audit and GemFire → Geode migration planning.

Everything in Patch
Cluster topology and security configuration audit
Region security and access control review
SOC 2 / HIPAA attestation package
GemFire → Geode migration assessment
WAN replication security review
24/7 reactive support

OSSeva Operate

Full MSP: 24/7 cluster monitoring, 15-min SLA, named Geode engineers.

Everything in Assure
24/7 cluster health and memory monitoring
15-minute P1 incident response SLA
Named senior Geode/GemFire engineer
Region eviction and overflow management
GemFire → Geode migration execution
Quarterly capacity planning reviews

All tiers priced per cluster/application — not per core.

How it installs

OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.

Maven — OSSeva Geode clientxml

<dependency>
  <groupId>io.osseva.geode</groupId>
  <artifactId>geode-core</artifactId>
  <version>1.15.1-osseva-1</version>
</dependency>
<dependency>
  <groupId>io.osseva.geode</groupId>
  <artifactId>geode-cq</artifactId>
  <version>1.15.1-osseva-1</version>
</dependency>

Docker — OSSeva Geode locator and serverbash

# Start locator
docker run -d --name geode-locator \
  -p 10334:10334 \
  -p 1099:1099 \
  artifacts.osseva.io/apache-geode:1.15.1-osseva-1 \
  gfsh start locator --name=locator1

# Start cache server
docker run -d --name geode-server \
  -p 40404:40404 \
  artifacts.osseva.io/apache-geode:1.15.1-osseva-1 \
  gfsh start server --name=server1 --locators=geode-locator[10334]

Migrate from VMware / Broadcom GemFire

Broadcom GemFire customers seeking an exit path can migrate to OSSeva-supported Apache Geode — the open-source foundation GemFire is built on. OSSeva provides migration assessment, data migration tooling, and cluster validation to move from commercial GemFire to community Geode under enterprise support.

↗

Pricing model

OSSeva for GemFire/Geode is priced per cluster — not per node or per stored GB. Book a discovery call for a quote.

Compliance library

📄SOC 2 compliance evidence package

Request →

📄Sample Audit Narrative

Request →

📄Pen-Test Report Summary

Request →

📄HIPAA Technical Safeguard Matrix

Request →

Questions

Frequently asked questions

Book a 15-minute call

What is the relationship between GemFire and Apache Geode?

Apache Geode is the open-source project that VMware (now Broadcom) GemFire is built on. GemFire is the commercial distribution with proprietary extensions. Most GemFire features are available in Geode — OSSeva's migration assessment identifies which proprietary GemFire features you're using and provides OSS alternatives.

Does OSSeva cover GemFire serialization vulnerabilities?

Yes. Java serialization and deserialization vulnerabilities are a priority class for GemFire/Geode coverage — they represent remote code execution risk when GemFire is accessible from untrusted networks. OSSeva patches serialization CVEs on an emergency timeline.

Can OSSeva operate GemFire on our infrastructure while we plan the Geode migration?

Yes. OSSeva Operate can cover the existing GemFire cluster while the Geode migration is planned and carried out. The migration does not need to finish before OSSeva support begins.

What does the GemFire → Geode migration assessment cover?

The migration assessment includes: proprietary GemFire feature inventory (PDX serialization, function execution, WAN replication, security manager), OSS equivalents for each, data migration strategy, cluster topology replication, and estimated migration timeline.

Does OSSeva support Spring Data GemFire / Spring Data Geode integration?

Yes. Spring Data GemFire and Spring Data Geode (the Spring framework integration layer) are included in OSSeva's Geode coverage. Customers using Spring Boot with embedded or client Geode get patched builds for both the Geode core and the Spring Data integration layer.

Who provides GemFire support besides Broadcom?

Broadcom (formerly VMware) sells and supports GemFire. Apache Geode, the open source project it is built on, has its own community, and cloud services and third-party support companies also cover data grid workloads. OSSeva supports both GemFire 9.x and 10.x and Geode 1.x and 2.x under one contract, including versions whose Broadcom support window has closed, and it runs on your infrastructure.

Does OSSeva support current GemFire and Geode versions or only end-of-life ones?

Both. OSSeva's support matrix lists GemFire 9.x and 10.x as extended, Geode 1.15.x and 2.x as current, and Geode 1.14.x as end of life with OSSeva patching. Broadcom's lifecycle portal shows GemFire 9.15 support ended on 31 October 2025 and 10.0 on 30 April 2026. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.

How is OSSeva GemFire support priced?

OSSeva for GemFire/Geode is priced per cluster, not per node or per stored GB. Patch covers the patched builds, Assure adds the audit work and 24/7 reactive support, and Operate adds proactive 24/7 monitoring with a 15-minute P1 SLA. Book a discovery call for a quote.

Get a quote

Ready to get GemFire / Geode patched and supported?

Tell us your GemFire / Geode versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.

Prefer to talk or read more first?

Book a 15-minute call See all tiers and pricing