-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsafe deserialization in Redisson's handling of Redis server responses. The SerializationCodec$Decoder.decode method triggers deserialization via ObjectInputStream.readObject(), which relies on CustomObjectInputStream.resolveClass to resolve classes. Before the fix, resolveClass lacked allowlist checks, allowing arbitrary class deserialization. The commit diff explicitly adds allowedClasses validation to these functions, confirming their role in the vulnerability. Together, these functions enabled untrusted data deserialization, leading to remote code execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.redisson:redisson | maven | < 3.22.0 | 3.22.0 |