97 matches found
CVE-2026-78066
Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...
EUVD-2026-107185
Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...
PT-2026-120543
Resource exhaustion in Apache bRPC version 1.18.0 on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1 Th...
com.alibaba:dubbo (>=2.5.4, <=2.6.0), com.alibaba:dubbo-rpc-webservice (>=2.6.1, <=2.6.2) +119 more potentially affected by CVE-2026-49875 via org.apache.cxf:cxf-core (3.0.14)
org.apache.cxf:cxf-core MAVEN version 3.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-core and may be impacted: - com.alibaba:dubbo =2.5.4, =2.6.1, =5.4.2, =5.3.0, =5.4.0 - com.custardsource.parfait:parfait-cxf 0.3.11 -...
ch.artaios:openchemlib-vaadin (>=2.0.0, <=2.4.1), ch.martinelli.oss:vaadin-jooq (2.1.1) +471 more potentially affected by CVE-2026-41715 via io.projectreactor.netty:reactor-netty (>=1.1.0, <=1.1.31)
io.projectreactor.netty:reactor-netty MAVEN version =1.1.0, =2.0.0, =3.1.0.5, =3.3.0.0, =5.0.0, =5.0.0, =1.1.5, =2.0.0, =4.2.0, =4.2.0, =4.9.0-beta.1, =4.9.0-beta.1, =4.9.0-beta.1, =3.0.0, =3.0.1 and more Source cves: CVE-2026-41715 Source advisory: GHSA-PFC9-2CQG-9WQ6...
com.alipay.sofa:rpc-sofa-boot (>=4.0.0-m1, <=4.0.0-m2), com.alipay.sofa:rpc-sofa-boot-starter (>=4.0.0-m1, <=4.0.0-m2) +21 more potentially affected by CVE-2026-50076 via org.apache.fory:fory-core (1.0.0)
org.apache.fory:fory-core MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fory:fory-core and may be impacted: - com.alipay.sofa:rpc-sofa-boot =4.0.0-m1, =4.0.0-m1, =1.9.2, =1.9.2, =1.9.2, =1.10.0 and more Source cves:...
EUVD-2020-23730
Malware in sbrugna...
EUVD-2024-2768
Malicious code in bioql PyPI...
ROS-20250526-08
Vulnerability in the soupheaderparsequalitylist function of the libsoup GUI library GNOME of Linux operating systems is related to a memory leak when parsing a quality list containing elements with all zeros. Exploitation of the vulnerability could allow an attacker acting remotely, gain access t...
CVE-2023-35839
A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload...
CVE-2024-23636
SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there i...
CVE-2024-46983
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
Remote Code Execution
com.alipay.sofa:hessian is vulnerable to Remote Code Execution. The vulnerability is due to a gadget chain that bypasses the SOFA Hessian protocol's blacklist protection mechanism. This gadget chain relies solely on JDK classes and does not require any third-party components. The issue is fixed i...
CVE-2024-46983
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
CVE-2024-46983
CVE-2024-46983 affects sofa-hessian (SOFA Hessian) where a gadget chain bypasses the blacklist that restricts deserialization. The vulnerability enables a dangerous chain using only JDK classes, with no third-party component reliance stated. The issue is addressed by updating the blacklist; upgra...
CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
CVE-2024-46983
sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...
GHSA-C459-2M73-67HJ SOFA Hessian Remote Command Execution (RCE) Vulnerability
Impact SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on...