OSSEVA FOR GEMFIRE / GEODE
GemFire — patched, protected, operated.
Broadcom's GemFire pricing and support uncertainty has enterprise teams evaluating Apache Geode as the exit path. OSSeva provides CVE coverage for both GemFire 9.x/10.x and Geode 1.x/2.x, plus migration services to move from commercial GemFire to OSSeva-supported Geode.
Last reviewed
Trusted globally by enterprises
Why now
Broadcom GemFire: support windows are closing
Broadcom's lifecycle portal shows GemFire 9.15 support ended on 31 October 2025 and 10.0 on 30 April 2026. Estates on those lines must upgrade to 10.1 or later, move to Apache Geode, or find other cover for the version they run.
Apache Geode is the open-source foundation — but needs enterprise support
Apache Geode is the upstream open-source project that GemFire is built on. Running Geode community without CVE patching and compliance documentation creates the same audit exposure as any other EOL open-source component.
In-memory data grids hold session state and sensitive data
GemFire and Geode deployments frequently store session tokens, financial data, and healthcare records. CVEs in the serialization layer, security manager, or network topology represent direct data exposure risks with immediate compliance implications.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| GemFire 9.x(Full CVE coverage) | Extended | Clean |
| GemFire 10.x(Full CVE coverage) | Extended | Clean |
| Geode 1.14.x(No further upstream 1.14 releases — OSSeva patched) | EOL | Clean |
| Geode 1.15.x(Upstream maintained) | Current | Clean |
| Geode 2.x | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for GemFire and Geode. Covers both commercial and community builds.
- Quarterly CVE patches for GemFire 9.x–10.x and Geode 1.x–2.x
- Serialization and deserialization CVE priority coverage
- Maven / Docker delivery
- Signed artifacts (GPG)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus cluster security audit and GemFire → Geode migration planning.
- Everything in Patch
- Cluster topology and security configuration audit
- Region security and access control review
- SOC 2 / HIPAA attestation package
- GemFire → Geode migration assessment
- WAN replication security review
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 cluster monitoring, 15-min SLA, named Geode engineers.
- Everything in Assure
- 24/7 cluster health and memory monitoring
- 15-minute P1 incident response SLA
- Named senior Geode/GemFire engineer
- Region eviction and overflow management
- GemFire → Geode migration execution
- Quarterly capacity planning reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
<dependency>
<groupId>io.osseva.geode</groupId>
<artifactId>geode-core</artifactId>
<version>1.15.1-osseva-1</version>
</dependency>
<dependency>
<groupId>io.osseva.geode</groupId>
<artifactId>geode-cq</artifactId>
<version>1.15.1-osseva-1</version>
</dependency># Start locator
docker run -d --name geode-locator \
-p 10334:10334 \
-p 1099:1099 \
artifacts.osseva.io/apache-geode:1.15.1-osseva-1 \
gfsh start locator --name=locator1
# Start cache server
docker run -d --name geode-server \
-p 40404:40404 \
artifacts.osseva.io/apache-geode:1.15.1-osseva-1 \
gfsh start server --name=server1 --locators=geode-locator[10334]Migrate from VMware / Broadcom GemFire
Broadcom GemFire customers seeking an exit path can migrate to OSSeva-supported Apache Geode — the open-source foundation GemFire is built on. OSSeva provides migration assessment, data migration tooling, and cluster validation to move from commercial GemFire to community Geode under enterprise support.
Pricing model
OSSeva for GemFire/Geode is priced per cluster — not per node or per stored GB. Book a discovery call for a quote.
Frequently asked questions
What is the relationship between GemFire and Apache Geode?
Apache Geode is the open-source project that VMware (now Broadcom) GemFire is built on. GemFire is the commercial distribution with proprietary extensions. Most GemFire features are available in Geode — OSSeva's migration assessment identifies which proprietary GemFire features you're using and provides OSS alternatives.
Does OSSeva cover GemFire serialization vulnerabilities?
Yes. Java serialization and deserialization vulnerabilities are a priority class for GemFire/Geode coverage — they represent remote code execution risk when GemFire is accessible from untrusted networks. OSSeva patches serialization CVEs on an emergency timeline.
Can OSSeva operate GemFire on our infrastructure while we plan the Geode migration?
Yes. OSSeva Operate can cover the existing GemFire cluster while the Geode migration is planned and carried out. The migration does not need to finish before OSSeva support begins.
What does the GemFire → Geode migration assessment cover?
The migration assessment includes: proprietary GemFire feature inventory (PDX serialization, function execution, WAN replication, security manager), OSS equivalents for each, data migration strategy, cluster topology replication, and estimated migration timeline.
Does OSSeva support Spring Data GemFire / Spring Data Geode integration?
Yes. Spring Data GemFire and Spring Data Geode (the Spring framework integration layer) are included in OSSeva's Geode coverage. Customers using Spring Boot with embedded or client Geode get patched builds for both the Geode core and the Spring Data integration layer.
Ready to get GemFire / Geode patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.