Orbital
All posts

Introducing OpenCast: security patches for open-source Hazelcast

We're maintaining an open source fork of Hazelcast, patching CVE's

Marty Pitt@marty_pitt

Introducing OpenCast: security patches for open-source Hazelcast

This week we released the first version of OpenCast, our fork of Hazelcast’s open-source components, maintained by Orbital to provide CVE patch releases.

We’re big users of Hazelcast. It’s a great product, and its open-source edition has served us well. OpenCast lets us keep using it while addressing security vulnerabilities on the timelines our customers need.

We’re already running it in Orbital, and we’re happy to share it with anyone facing the same problem.

Why we built it

In 2024, Hazelcast changed its approach to security patches. Enterprise customers receive CVE fixes as they become available; Community Edition users have to wait for the next major or minor release.

Those releases can be a long way apart. There were more than 14 months between Hazelcast 5.5 and 5.6, followed by nearly seven months before 5.7. As of October 2026, that’s just two Community Edition releases in the past two years.

That makes the release cadence a security concern. When a vulnerability needs fixing between releases, Community users have no upstream patch release to turn to.

Hazelcast gets to choose its commercial model. But tying security fixes to feature releases puts open-source users in a difficult position. Our customers need HIGH and CRITICAL vulnerabilities patched, on timelines that don’t necessarily line up with the next release.

Some affected dependencies, such as Jackson, are also shaded into Hazelcast’s JAR. We can’t fix those by simply overriding a dependency version in Maven.

So we’ve created OpenCast to publish patched versions of the Apache 2.0 components, staying as close to upstream as possible.

Available now

Our first release, 5.7.0-opencast-1, is based on Hazelcast 5.7.0 and includes security backports and dependency updates.

It addresses the CVEs that prompted us to create the fork. Our automated and exploratory testing in Orbital has found no regressions, and every OpenCast release goes through Orbital’s build and test suite before we publish it.

For the modules we publish, package names and configuration remain unchanged. The README includes Maven and Gradle instructions, along with details of the fixes.

What we’ll maintain

We’re keeping the scope deliberately small:

  • Security patches, on a best-efforts basis. There’s no SLA. We maintain this because we need it, and we’re sharing it because others probably do too.
  • A focus on HIGH and CRITICAL CVEs. Contributions fixing vulnerabilities of any severity are welcome.
  • Minimal changes from upstream. We backport existing fixes where possible. General bug fixes and new features remain with Hazelcast; issues introduced by our patches belong with us.
  • Apache 2.0 modules only. We don’t publish modules covered by the Hazelcast Community License, including hazelcast-sql and the Jet extensions. We also don’t publish distribution ZIPs or Docker images.
  • The release lines we use. Currently, that’s Hazelcast 5.7.

Get involved

If you need patched open-source Hazelcast releases, take a look at OpenCast. CVE fixes and feedback from testing it in your own applications are welcome.

We’d be happy to see Hazelcast resume Community Edition security patch releases. If that removes the need for this fork, we’ll migrate back and archive it.

Until then, we’re glad to contribute patches to software we rely on—and make them available to others who need them.