2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9497

CVE-2026-9497: TCC-TRANSACTION has an Improper Input Validation vulnerability

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9497

CVE-2026-9497:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.mengyun:tcc-transaction	maven	<= 2.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within the FastjsonTransactionSerializer class, which is responsible for serializing and deserializing transaction objects. The deserialize method uses Fastjson.parseObject with Feature.SupportAutoType enabled. This is a well-known security risk in the Fastjson library, as it allows an attacker to specify an arbitrary class to be instantiated during the deserialization process. If a gadget class is available on the classpath, this can lead to remote code execution. The clone method is also vulnerable as it internally calls the deserialize method. An attacker who can control the data being deserialized (for example, by poisoning the data in Redis as mentioned in the advisory) can exploit this vulnerability.

Vulnerable functions

org.mengyun.tcctransaction.serializer.json.FastjsonTransactionSerializer.deserialize

tcc-transaction-core/src/main/java/org/mengyun/tcctransaction/serializer/json/FastjsonTransactionSerializer.java

The function uses `com.alibaba.fastjson.JSON.parseObject` with the `Feature.SupportAutoType` flag enabled. This allows for deserialization of arbitrary classes, leading to a remote code execution vulnerability if an attacker can control the byte array input.

org.mengyun.tcctransaction.serializer.json.FastjsonTransactionSerializer.clone

tcc-transaction-core/src/main/java/org/mengyun/tcctransaction/serializer/json/FastjsonTransactionSerializer.java

This function calls the vulnerable `deserialize` function, and is therefore also vulnerable to the same deserialization attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.