What’s Vulnerable › Vulnerabilities

CVE-2020-9493: Java deserialization in Chainsaw

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-16 · updated 2026-10-07
• Weakness: CWE-502

Description

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

Affected products

• Apache Chainsaw: before 2.1.0 — fixed in 2.1.0
• Apache Log4j: from 1.2 before 2.0 — fixed in 2.0
• Qos Reload4J: before 1.2.18.1 — fixed in 1.2.18.1

How to fix

Upgrade to a fixed version: Apache Chainsaw 2.1.0; Apache Log4j 2.0; Qos Reload4J 1.2.18.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/06/16/1
• http://www.openwall.com/lists/oss-security/2022/01/18/5
• https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83%40%3Cannounce.apache.org%3E
• https://www.openwall.com/lists/oss-security/2021/06/16/1
• http://www.openwall.com/lists/oss-security/2021/06/16/1
• http://www.openwall.com/lists/oss-security/2022/01/18/5
• https://lists.apache.org/thread.html/r50d389c613ba6062a26aa57e163c09bfee4ff2d95d67331d75265b83%40%3Cannounce.apache.org%3E
• https://www.openwall.com/lists/oss-security/2021/06/16/1

Get alerted when CVE-2020-9493 or the next vulnerability affects your stack