CVE-2021-43297: apache software foundation apache dubbo Deserialization of Untrusted Data
Vulnerability summary
CVE-2021-43297 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache dubbo. EPSS estimates a 16.53% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
Timeline
- 10-01-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
16.53%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-0.44 pp
From 16.97% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- dubbo≥ 2.6.0, < 2.6.12 | ≥ 2.7.0, < 2.7.15 | ≥ 3.0.0, < 3.0.5
Apache software foundation1 product
- apache dubbo≥ Apache Dubbo 2.6.x, < 2.6.12 | ≥ Apache Dubbo 2.7.x, < 2.7.15 | ≥ Apache Dubbo 3.0.x, < 3.0.5
Org.apache.dubbo1 product
- dubbo≥ 2.6.0, < 2.6.12 | ≥ 2.7.0, < 2.7.15 | ≥ 3.0.0, < 3.0.5
3 vendors · 3 products
References
2 links- lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlwwX Refsource MISCWEBMailing ListVendor Advisory
