- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 16 · 1 critical, 1 medium
- Registry
- Maven Central
Advisories 16
- CVE-2023-46279Unrated
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
Affected: from 3.1.5, fixed in 3.1.6.
- CVE-2023-29234Unrated
Bypass serialize checks in Apache Dubbo
Affected: from 3.1.0, fixed in 3.1.11; from 3.2.0, fixed in 3.2.5.
- CVE-2023-23638Medium 5.0
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
Affected: fixed in 2.7.22; from 3.0.0, fixed in 3.0.13; from 3.1.0, fixed in 3.1.5.
- CVE-2022-39198Critical 9.8
Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
Affected: from 2.7.0, fixed in 2.7.18; from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.1.
- CVE-2022-24969Unrated
bypass of CVE-2021-25640
Affected: from 2.5.0, fixed in 2.7.15.
- CVE-2021-43297Unrated
Dubbo Hessian cause RCE when parse error
Affected: from 2.6.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.15; from 3.0.0, fixed in 3.0.5.
- CVE-2021-37579Unrated
Bypass deserialization checks in Apache Dubbo
Affected: fixed in 2.7.13; from 3.0.0, fixed in 3.0.2.
- CVE-2021-36161Unrated
Unprotected input value toString cause RCE
Affected: fixed in 2.7.13.
- CVE-2021-36163Unrated
Unsafe deserialization in providers using the Hessian protocol
Affected: from 2.7.0, fixed in 2.7.13; fixed in 2.6.10.1.
- CVE-2021-36162Unrated
Unprotected yaml deserialization cause RCE
Affected: fixed in 2.7.13; from 3.0.0, fixed in 3.0.2.
- CVE-2021-30180Unrated
Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Affected: from 2.7.0, fixed in 2.7.10.
- CVE-2021-30179Unrated
Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
Affected: from 2.5.0, fixed in 2.7.10.
- CVE-2021-25640Unrated
Open Redirect or SSRF vulnerability usage of parseURL
Affected: from 2.5.0, fixed in 2.7.10.
- CVE-2021-30181Unrated
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Affected: from 2.5.0, fixed in 2.7.10.
- CVE-2021-25641Unrated
Dubbo Zookeeper does not check serialization id
Affected: from 2.5.0, fixed in 2.7.8.
- CVE-2020-1948Unrated
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.
Affected: fixed in 2.7.7.