OSSEVA FOR HAZELCAST
Hazelcast support after end of life: patched IMDG 3.x, 4.x and older 5.x
Hazelcast support from OSSeva covers the IMDG 3.x, IMDG 4.x and older Platform 5.x releases that Hazelcast no longer patches. Hazelcast's advisory for CVE-2023-45859 lists fixes only on 5.2 and 5.3, so for 4.2, 5.0 and 5.1 the last release is still inside the affected range. Send your work email and an engineer replies within 1 business day.
| Who it is for | Teams running Hazelcast IMDG 3.12, 4.0 or 4.2, or Platform 5.3 and 5.5 |
|---|---|
| What you get | Patched member and client artifacts for the line you run, matched so both ends of a connection agree. Assure adds a grid audit, a costed comparison of the paths off 3.x and 4.x, and 24/7 reactive support. |
| How it is priced | Per cluster, not per member, GB or client connection. Ask for a quote. |
| What happens next | You send your work email, we confirm your version and components, and you get a coverage plan. |
Reply within 1 business day · No commitment · or book a 15-minute call
Last reviewed
Trusted globally by enterprises
Hazelcast support windows
Hazelcast gives a minor release two years of standard support, then 18 months of extended support without patches. Dates below are from Hazelcast's version support windows article as recorded by OSSeva on 30 September 2026; endoflife.date does not list Hazelcast.
| Line | Standard support ends | Extended support ends |
|---|---|---|
| 4.2 | 24 Mar 2023 | 24 Sep 2024 |
| 5.0 | 22 Sep 2023 | 22 Mar 2025 |
| 5.1 | 1 Mar 2024 | 1 Sep 2025 |
| 5.2 | 26 Oct 2024 | 24 Apr 2026 |
| 5.3 | 19 May 2025 | 19 Nov 2026 |
| 5.4 | 16 Apr 2026 | 16 Oct 2027 |
| 5.5 | 30 Jul 2026 | 30 Jan 2028 |
| 5.6 | 15 Oct 2027 | 15 Apr 2029 |
| 5.7 | 13 May 2028 | 13 Nov 2029 |
IMDG 3.12 has no published end dates. Since 5.4, patch releases go to Enterprise customers only.
Advisories with no fix on the line's last release
Two entries in OSSeva's CVE directory were published in February 2024. Both list upstream fixes on 5.2.5 and 5.3.5 and none for 5.1 and earlier, and the final release of each older line is inside the affected range, so upgrading within the line does not help.
| Line | Final release | Inside the affected range of |
|---|---|---|
| IMDG 4.2 | 4.2.8 | CVE-2023-45859 |
| Platform 5.0 | 5.0.5 | CVE-2023-45859 |
| Platform 5.1 | 5.1.7 | CVE-2023-45859 and CVE-2023-45860 |
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2023-45859 | 2024-02-28 | 7.6 | Hazelcast through 4.1.10, 4.2 to 4.2.8, 5.0 to 5.0.5, 5.1 to 5.1.7, 5.2.0 to 5.2.4, 5.3.0 to 5.3.4 | 5.2.5, 5.3.5; no fix for 5.1 and earlier |
| CVE-2023-45860 | 2024-02-16 | 6.5 | Hazelcast 5.1.7 and earlier, 5.2.0 to 5.2.4, 5.3.0 to 5.3.4 | 5.2.5, 5.3.5; no fix for 5.1 and earlier |
Final releases are from Hazelcast's release notes as recorded by OSSeva on 30 September 2026. Confirm any entry at nvd.nist.gov.
Why now
IMDG 3.x and 4.x are behind a line that keeps moving
Hazelcast has consolidated on the Platform 5.x series, with 5.5.0 in July 2024, 5.6.0 in October 2025 and 5.7.0 in May 2026. Deployments on IMDG 3.x or 4.x are several majors behind an actively moving line, and the further back they sit, the less likely a fix is ever backported to them.
Open core means the free edition and the supported edition are not the same product
Hazelcast splits community and enterprise editions, with features including WAN replication, persistence, security hardening and rolling upgrades on the commercial side. Teams that deployed the community edition to avoid licensing then find that support, and the operational tooling that makes upgrades safe, are exactly what they opted out of.
The grid holds session state, and the grid speaks Java serialization
Hazelcast clusters typically hold HTTP session state, cached credentials and hot business data, and members exchange serialized Java objects over the cluster protocol. Deserialization advisories in this class of product are remote code execution with the grid's own trust level — and clusters are often deployed flat, with member ports reachable more widely than intended.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| IMDG 3.12.x(Several majors behind — OSSeva patched) | EOL | Clean |
| IMDG 4.0.x(Several majors behind — OSSeva patched) | EOL | Clean |
| IMDG 4.2.x(Several majors behind — OSSeva patched) | EOL | Clean |
| Platform 5.3.x(Superseded — OSSeva patched) | Extended | Clean |
| Platform 5.5.x(Released Jul 2024) | Extended | Clean |
| Platform 5.7.x(Released May 2026) | Current | Clean |
Running a Hazelcast version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for the Hazelcast line you run, no subscription required.
- Security backports for IMDG 3.x, 4.x and older Platform 5.x
- Deserialization and cluster protocol advisory priority coverage
- Client library patching in step with member builds
- Maven / Docker delivery
- Signed artifacts (GPG)
- Cluster security audit
- 24/7 managed operations
OSSeva Assure
Patch plus grid audit and a costed comparison of the paths off 3.x / 4.x.
- Everything in Patch
- Cluster topology, partition and split-brain review
- Member port exposure and join-mechanism audit
- Serialization configuration and class filtering review
- SOC 2 / HIPAA attestation package
- Upgrade or migration options assessment
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 grid monitoring, 15-min SLA, named data grid engineers.
- Everything in Assure
- 24/7 heap, partition and member health monitoring
- 15-minute P1 incident response SLA
- Named senior in-memory data grid engineer
- Eviction, near-cache and backup-count tuning
- Rolling upgrade or migration execution
- Quarterly capacity planning reviews
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version and member list from the REST endpoint
curl -s http://hazelcast:5701/hazelcast/rest/cluster
# Confirm the member port is not reachable beyond the cluster subnet.
# Hazelcast members trust each other; anything that can join, can read.
nmap -p 5701-5703 hazelcast-member.internal
# From a client application
java -cp hazelcast.jar com.hazelcast.instance.BuildInfoProvider<dependency>
<groupId>io.osseva.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
<version>4.2.8-osseva-1</version>
</dependency>
<!-- Client and member artifacts are built and released together
so both ends of a connection stay on the same patch level. -->
<dependency>
<groupId>io.osseva.hazelcast</groupId>
<artifactId>hazelcast-client</artifactId>
<version>4.2.8-osseva-1</version>
</dependency>Migrate from Unsupported Hazelcast IMDG 3.x / 4.x
OSSeva patches the Hazelcast line already in production, so the serialization format, cluster protocol and client compatibility your applications depend on stay fixed. Where a move makes sense, the assessment compares upgrading within Hazelcast against migrating to an alternative grid, costed against the features actually in use rather than the feature matrix.
Pricing model
OSSeva for Hazelcast is priced per cluster — not per member, per GB stored or per client connection.
When does Hazelcast end of life apply to a release?
Hazelcast gives each minor release two years of standard support, then 18 months of extended support without patches, according to its version support windows article as recorded by OSSeva on 30 September 2026. On that schedule Platform 5.2 left standard support on 26 October 2024 and 5.3 on 19 May 2025. IMDG 3.12 has no published end dates, and the last releases of 4.2, 5.0 and 5.1 sit inside the range of CVE-2023-45859.
Is Hazelcast open source?
It is open core. There is a community edition and a commercial edition, and features that enterprises rely on — including WAN replication, persistence, additional security hardening and rolling upgrade tooling — sit on the commercial side. Teams that chose the community edition to avoid licensing costs generally also opted out of support and of the tooling that makes upgrades low-risk.
What happens to Hazelcast IMDG 3.x and 4.x deployments?
They fall further behind with each Platform release. Development has consolidated on the 5.x line, with 5.7.0 released in May 2026, and fixes are not backported several majors down. A 3.12 or 4.2 cluster is stable but static — it will not receive security updates from upstream.
How risky is an unpatched in-memory data grid, really?
Higher than most teams assume, for two reasons. Grids hold session state and cached credentials, so a read is immediately valuable. And members exchange serialized Java objects with implicit trust in one another, which makes deserialization advisories in this class of product remote code execution rather than information disclosure. Clusters deployed on a flat network compound both.
Can OSSeva upgrade a Hazelcast cluster without downtime?
Within a line, usually yes — members are replaced one at a time with partitions rebalanced as they leave and rejoin. Across majors it depends on whether the serialization format and client protocol are compatible, which is what the Assure assessment establishes before anything is scheduled.
How does Hazelcast compare to GemFire, Geode and Ignite for our workload?
They overlap heavily and the right answer depends on which features you actually use rather than which product is broadly better. OSSeva covers all four, so the assessment is not a sales exercise for one of them — see the GemFire and Ignite coverage for how those estates are handled.
Who provides Hazelcast support besides Hazelcast Inc.?
Hazelcast support attaches to a commercial subscription, and since 5.4 patch releases go to Enterprise customers only. Cloud managed services and third-party support companies are the other usual sources. OSSeva supports community Hazelcast on IMDG 3.x, 4.x and Platform 5.x with no subscription required. It includes end-of-life versions, runs on your infrastructure, and sits under one contract with the rest of your stack.
Does OSSeva support current Hazelcast versions or only end-of-life ones?
Both. OSSeva's support matrix lists Platform 5.7.x as current, Platform 5.3.x and 5.5.x as extended, and IMDG 3.12.x, 4.0.x and 4.2.x as end of life with OSSeva patching. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.
How is OSSeva Hazelcast support priced?
OSSeva for Hazelcast is priced per cluster, not per member, per GB stored or per client connection. Patch covers the patched builds, Assure adds the audit work and 24/7 reactive support, and Operate adds proactive 24/7 monitoring with a 15-minute P1 SLA. Book a discovery call for a quote.
Get a quote
Ready to get Hazelcast patched and supported?
Tell us your Hazelcast versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?