Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.alibaba:dubbo

5 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5
Registry
Maven Central

Advisories 5

  • bypass of CVE-2021-25640

    Affected: from 2.5.0, fixed in 2.6.12.

  • Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

    Affected: from 2.5.0, fixed in 2.6.9.

  • Open Redirect or SSRF vulnerability usage of parseURL

    Affected: from 2.5.0, fixed in 2.6.9.

  • Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

    Affected: from 2.5.0, fixed in 2.6.9.

  • Dubbo Zookeeper does not check serialization id

    Affected: from 2.5.0, fixed in 2.6.9.