EUVD-2026-31730
GHSA-4r4v-3jc5-hrg9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unsafe deserialization in changmingxie tcc-transaction (versions up to 2.1.0) allows a remotely authenticated attacker with low privileges to exploit the Fastjson AutoType feature via the REST API, achieving limited confidentiality, integrity, and availability impact on the affected system. A proof-of-concept exploit exists (CVSS 4.0 E:P), referenced in a public GitHub bug report, though EPSS probability sits at just 0.04% (12th percentile) and SSVC assesses exploitation as none at time of analysis, indicating no observed active abuse. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been released.
Technical ContextAI
tcc-transaction is a Java-based distributed transaction framework by changmingxie that implements the TCC (Try-Confirm-Cancel) pattern. The vulnerable component is the Fastjson.parseObject function exposed through a REST API endpoint. Fastjson is a high-performance Java JSON serialization library; its AutoType feature allows JSON payloads to specify arbitrary Java class names via the @type field, which Fastjson then attempts to instantiate and populate during parsing. This design enables deserialization gadget chain attacks, classified under CWE-502 (Deserialization of Untrusted Data), where attacker-controlled class instantiation can trigger unintended code paths within the JVM classpath. Affected products per EUVD and CPE data are tcc-transaction 2.0 and 2.1.0 (CPE: cpe:2.3:a:changmingxie:tcc-transaction:*:*:*:*:*:*:*:*).
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. As a primary compensating control, administrators should disable Fastjson's AutoType feature by calling ParserConfig.getGlobalInstance().setSafeMode(true) in application startup code, which prevents arbitrary class instantiation during JSON parsing; note this may break legitimate application functionality that relies on polymorphic type handling and should be tested before deployment. As a secondary control, restrict network access to the tcc-transaction REST API endpoints to trusted internal networks or authenticated API gateways only, reducing the pool of potential attackers (PR:L indicates low-privilege authentication is currently required, so tightening this to specific roles or IP allowlists further limits exposure). Monitor for upgrades to tcc-transaction beyond 2.1.0 if the project resumes development. The public PoC is available at https://github.com/Ku4D3/bug_story/blob/main/report_01.md and should be used for internal detection rule development.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today