The vulnerability of the org.apache.xmlrpc.parser.XmlRpcResponseParser.addResult method in the Apache XML-RPC library, related to the restoration of unreliable data in memory, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

🗓️ 07 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Issue in Apache XML-RPC addResult enables deserialization via faultCause, risking data disclosure.

Reporter	Title	Published	Views	Family All 56
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Xml-Rpc	19 Jan 202002:57	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI (CVE-2019-17570, CVE-2025-64775)	26 Feb 202603:23	–	ibm
Tenable Nessus	Amazon Linux 2 : xmlrpc (ALAS-2023-2080)	8 Jun 202300:00	–	nessus
Tenable Nessus	Debian DLA-2078-1 : libxmlrpc3-java security update	31 Jan 202000:00	–	nessus
Tenable Nessus	Debian DSA-4619-1 : libxmlrpc3-java - security update	7 Feb 202000:00	–	nessus
Tenable Nessus	GLSA-202401-26 : Apache XML-RPC: Multiple Vulnerabilities	22 Jan 202400:00	–	nessus
Tenable Nessus	RHEL 6 / 7 : rh-java-common-xmlrpc (RHSA-2020:0310)	23 Jan 202300:00	–	nessus
Tenable Nessus	RHEL 7 : xmlrpc (Unpatched Vulnerability)	3 Jun 202400:00	–	nessus
Tenable Nessus	Ubuntu 16.04 LTS / 18.04 LTS : Apache XML-RPC vulnerability (USN-4496-1)	15 Sep 202000:00	–	nessus
Tenable Nessus	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xmlrpc (UTSA-2026-016592)	22 May 202600:00	–	nessus

Vulners

Node

red_hat red_hat_virtualizationMatch4

OR

red_hat red_hat_jboss_fuseMatch7

OR

red_hat red_hat_jboss_fuseMatch6

OR

apache xml-rpcRange<3.1.3-7

OR

red_hat red_hat_enterprise_linuxMatch7

OR

fedora fedoraMatch32

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-17570
access	www.access.redhat.com/errata/RHSA-2020:0310
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/I3QCRLJYQRGVTIYF4BXYRFSF3ONP3TBF/
lists	www.lists.apache.org/thread.html/846551673bbb7ec8d691008215384bcef03a3fb004d2da845cfe88ee%401390230951%40%3Cdev.ws.apache.org%3E
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-17570
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-17570
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-2778
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-3109
web	www.web.nvd.nist.gov/view/vuln/detail

01 Jun 2026 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 39.8

CVSS 210

EPSS0.49285

apache rpc library addResult method deserialization fault cause server side deserialization data disclosure risk