Dubbo CVE-2023-46279

A deserialization vulnerability existed when decode a malicious package.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Ra

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.7.x vers

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malic

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the con

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for

In Apache Dubbo, users may choose to use the Hessian protocol. Rated critical severity (CVSS 9.8), this vulnerability is

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the r

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. R

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfa

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on.

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. Rated critical severity (CVSS 9.8), this v

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). Rate