Vulnerability in Apache Software Foundation Dubbo
CVE-2021-25641
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by ta…
EPSS: 0.746 (98.9th percentile) — read the EPSS interpretation.
Affected products
- Apache Software Foundation Dubbo — versions Apache Dubbo 2.7.x, Apache Dubbo 2.6.x
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2021-25641?
- CVE-2021-25641 is a vulnerability in Apache Software Foundation Dubbo. Published 2021-05-29.
- Is CVE-2021-25641 known to be exploited?
- 24 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.