dubbo-rce

CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...

CVE-2023-38035-MobileIron-RCE

MobileIron CVE-2023-38035 Exploit README.md Descrizione Questo script bash automatizza il processo di scansione dei sistemi MobileIron vulnerabili che sono suscettibili all'exploit CVE-2023-38035. Lo script esegue più controlli, tra cui la verifica dei programmi richiesti, il download di potenzia...

CVE-2021-43297-POC

CVE-2021-43297 Descrizione della vulnerabilità Nelle versioni di Dubbo Hessian-Lite 3.2.11 e precedenti esiste un potenziale rischio di attacco RCE. Quando Hessian-Lite incontra un'eccezione di serializzazione, genera informazioni correlate, il che può innescare il metodo toString di alcuni Bean...

dubbo-CVE-2023-23638

CVE-2023-23638 Nur für Lern- und Forschungszwecke ZooKeeper selbst bereitstellen Die Testumgebung ist Java 8, andere Versionen wurden nicht getestet, die Funktionsfähigkeit wird nicht garantiert. Für die Reproduktion muss dem DemoComsumer der VM-Parameter -Ddubbo.hessian.allowNonSerializable=true...

Dubbo-deserialization

Apache Dubbo Deserialisierungs-Schwachstellenforschung Dieses Repository enthält Forschungsmaterialien, Proof-of-Concept-Code und Exploitation-Tools im Zusammenhang mit Deserialisierungs-Schwachstellen in Apache Dubbo, mit besonderem Fokus auf CVE-2020-1948. Repository-Struktur Verzeichnisse...

CVE-2026-19826 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

Apache HugeGraph-Server Deserialization Vulnerability

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...

CVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Remote Code Execution (RCE)

org.apache.dubbo:dubbo is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization handling in hessian-lite during exception logging, which allows an attacker to execute malicious code through crafted serialized data...

Remote Code Execution (RCE)

org.apache.hugegraph, hg-pd-core is vulnerable to a Remote Code Execution. The vulnerability is due to insecure Hessian deserialization in the Raft cluster membership logic, where a malicious Raft node can send crafted objects that bypass type safety and trigger unsafe deserialization and attacke...

GHSA-Q37J-3367-FWV7 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via insecure Hessian deserialization in the PD store. An attacker can execute arbitrary code by sending maliciously crafted data from a compromised or rogue Raft node. Details Serialization is a process...

EUVD-2025-203068

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

CVE-2025-26866

CVE-2025-26866 affects Apache HugeGraph-Server (HugeGraph-Server PD store) via insecure Hessian deserialization and RAFT-related manipulation, enabling remote code execution. Multiple sources describe a server-side deserialization vulnerability stemming from Hessian deserialization, with the miti...

Apache HugeGraph-Server 安全漏洞

Apache HugeGraph-Server is a server-side process for graph databases from the Apache Foundation. Apache HugeGraph-Server suffers from a deserialization vulnerability that stems from insecure Hessian deserialization in the PD store, which can be exploited by an attacker to cause remote code...