Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-46279 EUVD-2023-3171GHSA-97rv-88gf-phvr

Apache Dubbo: Bypass deny serialize list check in Apache Dubbo

Published Dec 15, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Dubbo Package: org.apache.dubbo:dubbo Ecosystem: Maven

Description

Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.

Users are recommended to upgrade to the latest version, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Dubbo 3.1.5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dubbo:dubbo >= 3.1.5, < 3.1.6 3.1.6 GHSA-97rv-88gf-phvr

References