CVE-2021-25641

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following t...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

The 0xDABB of Doom - CVE-2021-25641-Proof-of-Concept Apache/Al...