CVE-2022-36364

CVE-2022-36364 is a high-severity vulnerability affecting Apache Calcite Avatica JDBC driver versions prior to 1.22.0. It allows for potential code execution, and in rare cases remote code execution, due to improper validation of the httpclient_impl connection property. An attacker with privileges to control JDBC connection parameters could exploit this by instantiating arbitrary classes that have a constructor accepting a URL parameter and can execute code. The vulnerability has a CVSS score of 8.8 (HIGH), indicating a network attack vector with low attack complexity and high impact on confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or inclusion in CISA's KEV catalog, the vulnerability has garnered some community discussion and media coverage.