Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .9991 100.0 YES
AFFECTED Product Versions Fixed jai-ext < 1.1.22 – —
TIMELINE Feb 10 Reserved by GitHub_M Apr 13 Published (CNA: GitHub_M) Jun 26 Added to CISA KEV, remediation due 2024-07-17
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
| Date | Event | Detail |
|---|---|---|
| February 10, 2022 | Reserved | Reserved by GitHub_M |
| April 13, 2022 | Published | Published (CNA: GitHub_M) |
| June 26, 2024 | KEV ADDED | Added to CISA KEV, remediation due 2024-07-17 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| geosolutions-it | jai-ext | — | < 1.1.22 | — |
Authoritative record: CVE-2022-24816 at cve.org
Vendors: geosolutions-it
Weaknesses: CWE-94
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-24816 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
