-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.alibaba:hessian-lite | maven | <= 3.2.12 | 3.2.13 |
| org.apache.dubbo:dubbo | maven | >= 2.7.0, <= 2.7.17 | 2.7.18 |
| org.apache.dubbo:dubbo | maven | >= 3.0.0, <= 3.0.11 | 3.0.12 |
| org.apache.dubbo:dubbo | maven | = 3.1.0 | 3.1.1 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure deserialization in hessian-lite <=3.2.12. The patch in 3.2.13 explicitly added checks for Serializable implementation and updated deny lists, indicating that prior versions lacked these critical validations. The SerializerFactory's deserializer resolution (getObjectDeserializer) and the core deserialization entry point (Hessian2Input.readObject) are the logical points where these security controls were missing. Dubbo's dependency updates to hessian-lite 3.2.13 in their patched versions confirm the root cause lies in hessian-lite's deserialization logic.
Ongoing coverage of React2Shell