CVE-2019-17564

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-01 · updated 2026-06-17
Weakness: CWE-502

Description

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.

Affected products

Apache Software Foundation Apache Dubbo: from 2.5.0 through 2.5.10; from 2.6.0 through 2.6.7; from 2.7.0 through 2.7.4

References

https://advisory.checkmarx.net/advisory/CX-2020-4275
https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E
https://advisory.checkmarx.net/advisory/CX-2020-4275
https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E

Get alerted when CVE-2019-17564 or the next vulnerability affects your stack