Which versions of Java are affected by CVE-2026-4735?

CVE-2026-4735 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.7.. A patch is available.

How to fix or mitigate CVE-2026-4735?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Java CVE-2026-4735

Q: What is the CVSS score of CVE-2026-4735?

CVE-2026-4735 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-14708 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-24 GovTech CSG

GHSA-q9jc-xq58-m52x

Deserialization Java

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 03:30 euvd

EUVD-2026-14708

Analysis Generated

Mar 24, 2026 - 03:30 vuln.today

Patch released

Mar 24, 2026 - 03:30 nvd

Patch available

CVE Published

Mar 24, 2026 - 03:08 nvd

HIGH 8.7

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java.

This issue affects chunjun: before 1.16.1.

AnalysisAI

A deserialization of untrusted data vulnerability exists in DTStack chunjun versions prior to 1.16.1, specifically in the GsonUtil.java module within chunjun-core. An attacker can exploit this CWE-502 flaw to execute arbitrary code by crafting malicious serialized objects that are processed during deserialization. The vulnerability is reportedly patched as of version 1.16.1, with a patch available from the vendor via GitHub pull request #1939.

Technical ContextAI

The vulnerability resides in the Gson deserialization utility (GsonUtil.java) used by DTStack chunjun, a data integration framework written in Java. CWE-502 (Deserialization of Untrusted Data) represents a fundamental weakness where untrusted input is deserialized without proper validation, allowing attackers to instantiate arbitrary Java objects or invoke gadget chains. The affected product is identified via CPE cpe:2.3:a:dtstack:chunjun:*:*:*:*:*:*:*:*, indicating all versions of chunjun prior to 1.16.1 are in scope. Gson is a widely-used JSON serialization library, and improper use without type validation during deserialization creates a direct path to remote code execution in Java applications.

RemediationAI

Immediately upgrade DTStack chunjun to version 1.16.1 or later to obtain the vendor patch. Review and apply the changes documented in GitHub pull request #1939 (https://github.com/DTStack/chunjun/pull/1939) to understand the specific fixes applied to GsonUtil.java. Until patching is completed, restrict network access to chunjun instances to trusted sources only, disable or isolate chunjun components that process untrusted JSON input, and monitor deserialization operations for unusual object instantiation patterns. Implement input validation and consider using alternative serialization libraries with stricter type control if feasible.