Skip to content
CVE IDCVE-2022-24329GitHub advisory IDGHSA-2qp4-g3q3-f92w

Improper Locking in JetBrains Kotlin

CVE-2022-24329 (GitHub advisory GHSA-2qp4-g3q3-f92w) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.3, classed as Improper Locking (CWE-667), in org.jetbrains.kotlin:kotlin-stdlib (Maven). Affected versions: <= 1.5.32. It is fixed in 1.6.0.

Medium5.3Fix availableGitHub reviewed

Published 25 Feb 2022Updated 29 Oct 2024

5.3MediumCVSS 3.1
CVE ID
CVE-2022-24329
GHSA ID
GHSA-2qp4-g3q3-f92w
EPSS
2.21%higher than 81% of CVEs
Weaknesses (CWE)
  • CWE-667Improper Locking
  • CWE-829Inclusion of Functionality from Untrusted Control Sphere
KEV status
Not in KEV
Published
25 Feb 2022
Updated
29 Oct 2024
Ecosystem
  • Maven
Assigned by (CNA)
mitre

Summary

Source: OSV (GitHub advisory)

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Medium5.3Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
None
Integrity I
Low
Availability A
None

Affected packages

Source: OSV (GitHub advisory)

  • org.jetbrains.kotlin:kotlin-stdlib
    Maven
    pkg:maven/org.jetbrains.kotlin/kotlin-stdlib
    Affected versions
    <= 1.5.32
    Fixed in
    1.6.0
    Show 172 listed versions
    • 0.0.1-test-deploy
    • 0.0.2-test-deploy
    • 0.10.1316
    • 0.10.195
    • 0.10.4
    • 0.10.709
    • 0.10.770
    • 0.11.91
    • 0.11.91.1
    • 0.11.91.2
    • 0.11.91.4
    • 0.12.1218

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 1.6.0 or later.

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 829d1d8Release commit1.6.0github.com/jetbrains/kotlin

Vulnerability intelligence

References

Questions about CVE-2022-24329

What is the GHSA ID for CVE-2022-24329?
GitHub tracks CVE-2022-24329 as GHSA-2qp4-g3q3-f92w.
What is the CVSS score of CVE-2022-24329?
CVE-2022-24329 has a CVSS 3.1 base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Which versions are affected by CVE-2022-24329?
org.jetbrains.kotlin:kotlin-stdlib (Maven): <= 1.5.32.
How do I fix CVE-2022-24329?
Upgrade to 1.6.0 or later.
What is the Package URL (PURL) for CVE-2022-24329?
The affected package's PURL is pkg:maven/org.jetbrains.kotlin/kotlin-stdlib.
Is CVE-2022-24329 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-24329. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 81% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 14:01 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.