Description
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Dubbo | Apache Dubbo 2.7.x – ≤ 2.7.21, Apache Dubbo 3.0.x – ≤ 3.0.13, Apache Dubbo 3.1.x – ≤ 3.1.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 4 repositories
-
YYHYlh/Apache-Dubbo-CVE-2023-23638-exp ★ 229 · May 11, 2023
Apache Dubbo (CVE-2023-23638)漏洞利用的工程化实践
-
X1r0z/dubbo-rce ★ 34 · Mar 22, 2023
PoC of Apache Dubbo CVE-2023-23638
-
cuijiung/dubbo-CVE-2023-23638 ★ 1 · Jul 11, 2025
-
P4x1s/CVE-2023-23638-Tools ★ 0 · Jun 8, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.dubbo:dubbo | < 2.7.22 | 2.7.22 | GHSA-933g-v89r-x8pf |
| Maven | org.apache.dubbo:dubbo | >= 3.0.0, < 3.0.13 | 3.0.13 | GHSA-933g-v89r-x8pf |
| Maven | org.apache.dubbo:dubbo | >= 3.1.0, < 3.1.5 | 3.1.5 | GHSA-933g-v89r-x8pf |
References
- https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb vendor-advisory