Apache-Dubbo-Hessian2-CVE-2021-43297

Apache Dubbo Hessian2例外処理時の逆シリアライゼーション（CVE-2021-43297） 1. 2つのプロジェクトをそれぞれ2つのideaにインポートする 2. 最初にorg.apache.dubbo.samples.basic.BasicProvidermainを実行してサーバー側を起動する 3. 次にorg.apache.dubbo.samples.basic.BasicConsumermainを実行してクライアント攻撃側を起動する 効果： https://paper.seebug.org/1814/...

CVE-2026-19826 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

CVE-2026-19826

CVE-2026-19826 affects alldatacenter alldata up to version 0.6.8, specifically the Hessian2Input.readObject function in HessianSerializer.java within the xxl-rpc Listener. The issue is a deserialization flaw described as enabling remote exploitation, with an exploit already public. The CVE notes ...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

PT-2026-72018

Name of the Vulnerable Software and Affected Versions alldatacenter alldata versions prior to 0.6.9 Description A remote deserialization issue exists within the xxl-rpc Listener component, specifically in the Hessian2Input.readObject function located in the /serialize/impl/HessianSerializer.java...

CVE-2020-11995

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

GHSA-74MG-6XQX-2VRQ Deserialization exploitation in Apache Dubbo

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

Deserialization exploitation in Apache Dubbo

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

Apache Dubbo Deserialization Vulnerability (CNVD-2022-05106)

Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation in the United States. The product provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery. Apache Dubbo in version 3.2.11 a...

Apache Dubbo 代码问题漏洞

Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation in the United States. The product provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery. Apache Dubbo in version 3.2.11 a...

CVE-2020-11995

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

CVE-2020-11995

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

Deserialization of untrusted data

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...

CVE-2020-11995 Apache Dubbo default deserialization protocol Hessian2 cause CRE

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored...