OSSEVA FOR HAZELCAST
Open core, closed support window.
Hazelcast development runs on the Platform 5.x line — 5.7.0 shipped 13 May 2026. IMDG 3.x and 4.x deployments, and older 5.x releases, sit outside it. Under an open-core model, staying on the community edition without a subscription means staying without patches.
Why now
IMDG 3.x and 4.x are behind a line that keeps moving
Hazelcast has consolidated on the Platform 5.x series, with 5.5.0 in July 2024, 5.6.0 in October 2025 and 5.7.0 in May 2026. Deployments on IMDG 3.x or 4.x are several majors behind an actively moving line, and the further back they sit, the less likely a fix is ever backported to them.
Open core means the free edition and the supported edition are not the same product
Hazelcast splits community and enterprise editions, with features including WAN replication, persistence, security hardening and rolling upgrades on the commercial side. Teams that deployed the community edition to avoid licensing then find that support, and the operational tooling that makes upgrades safe, are exactly what they opted out of.
The grid holds session state, and the grid speaks Java serialization
Hazelcast clusters typically hold HTTP session state, cached credentials and hot business data, and members exchange serialized Java objects over the cluster protocol. Deserialization advisories in this class of product are remote code execution with the grid's own trust level — and clusters are often deployed flat, with member ports reachable more widely than intended.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| IMDG 3.12.x(Several majors behind — OSSeva patched) | EOL | Clean |
| IMDG 4.0.x(Several majors behind — OSSeva patched) | EOL | Clean |
| IMDG 4.2.x(Several majors behind — OSSeva patched) | EOL | Clean |
| Platform 5.3.x(Superseded — OSSeva patched) | Extended | Clean |
| Platform 5.5.x(Released Jul 2024) | Extended | Clean |
| Platform 5.7.x(Released May 2026) | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for the Hazelcast line you run, no subscription required.
- Security backports for IMDG 3.x, 4.x and older Platform 5.x
- Deserialization and cluster protocol advisory priority coverage
- Client library patching in step with member builds
- Maven / Docker delivery
- Signed artifacts (GPG)
- Cluster security audit
- 24/7 managed operations
OSSeva Assure
Patch plus grid audit and a costed comparison of the paths off 3.x / 4.x.
- Everything in Patch
- Cluster topology, partition and split-brain review
- Member port exposure and join-mechanism audit
- Serialization configuration and class filtering review
- SOC 2 / HIPAA attestation package
- Upgrade or migration options assessment
- 24/7 managed operations
OSSeva Operate
Full MSP: 24/7 grid monitoring, 15-min SLA, named data grid engineers.
- Everything in Assure
- 24/7 heap, partition and member health monitoring
- 15-minute P1 incident response SLA
- Named senior in-memory data grid engineer
- Eviction, near-cache and backup-count tuning
- Rolling upgrade or migration execution
- Quarterly capacity planning reviews
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version and member list from the REST endpoint
curl -s http://hazelcast:5701/hazelcast/rest/cluster
# Confirm the member port is not reachable beyond the cluster subnet.
# Hazelcast members trust each other; anything that can join, can read.
nmap -p 5701-5703 hazelcast-member.internal
# From a client application
java -cp hazelcast.jar com.hazelcast.instance.BuildInfoProvider<dependency>
<groupId>io.osseva.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
<version>4.2.8-osseva-1</version>
</dependency>
<!-- Client and member artifacts are built and released together
so both ends of a connection stay on the same patch level. -->
<dependency>
<groupId>io.osseva.hazelcast</groupId>
<artifactId>hazelcast-client</artifactId>
<version>4.2.8-osseva-1</version>
</dependency>Migrate from Unsupported Hazelcast IMDG 3.x / 4.x
OSSeva patches the Hazelcast line already in production, so the serialization format, cluster protocol and client compatibility your applications depend on stay fixed. Where a move makes sense, the assessment compares upgrading within Hazelcast against migrating to an alternative grid, costed against the features actually in use rather than the feature matrix.
Pricing model
OSSeva for Hazelcast is priced per cluster — not per member, per GB stored or per client connection.
Frequently asked questions
Which versions of RabbitMQ are past community end-of-life?
RabbitMQ 3.8.x, 3.9.x, 3.10.x, 3.11.x, and 3.12.x have all reached community EOL — meaning no further security patches or CVE fixes are released by the RabbitMQ maintainers for those versions. RabbitMQ 3.13.x reached EOL in late 2024. OSSeva delivers backported CVE patches for 3.11 through 3.13.
Which PostgreSQL versions are no longer receiving community security patches?
PostgreSQL 9.6 through 13 have all reached community EOL. PostgreSQL 11 reached EOL November 2023, PostgreSQL 12 reached EOL November 2024, and PostgreSQL 13 reaches EOL November 2025. OSSeva provides extended security patching for PostgreSQL 11, 12, and 13 for teams that cannot immediately migrate to PG 14 or later.
Is Spring Framework 5.3.x still supported?
Spring Framework 5.3.x reached its community OSS EOL on December 31, 2024. Broadcom's commercial support for Spring 5.3.x is also no longer available under standard terms. OSSeva delivers backported CVE patches for Spring Framework 5.3.x and Spring Boot 2.7.x under our extended lifecycle support program.
Which versions of Apache Kafka are EOL?
Apache Kafka versions 2.x and 3.0 through 3.4 are past their community supported window, meaning no further patch releases. Kafka 3.5 and 3.6 have reached or are approaching EOL. OSSeva supports Kafka 2.8 through 3.5 with backported security patches and compliance documentation.
What happened to Redis licensing? Can I still use Redis for free?
In March 2024, Redis Ltd. changed the Redis license from BSD-3-Clause to the Business Source License (BSL 1.1), which restricts use in competing database products. The Valkey project (a Linux Foundation fork) continues under BSD-3-Clause. OSSeva maintains BSD-licensed, CVE-patched builds of Redis 6.2 and 7.0 for enterprises that need verifiable open-source licensing alongside security coverage.
Is Node.js 18 still receiving security patches?
Node.js 18 (LTS 'Hydrogen') reached its end-of-life date in April 2025 and no longer receives security releases from the Node.js project. OSSeva delivers CVE patches for Node.js 18 for enterprise teams that have not yet migrated to Node.js 20 or 22.
Is Apache Tomcat 8.5 still supported?
Apache Tomcat 8.5 reached its community EOL in March 2024. OSSeva provides extended security patching for Tomcat 8.5.x for teams running Java EE 7 workloads that cannot immediately migrate to Tomcat 9.0 or 10.1.
What .NET versions does OSSeva support?
.NET 6 reached Microsoft end-of-support in November 2024. .NET 7 reached EOL in May 2024. OSSeva delivers CVE patches for .NET 6 and .NET 7 for teams that have not yet migrated to .NET 8 (LTS, supported through November 2026).
Ready to get Hazelcast patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.