CVE-2021-31819

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-22 · updated 2026-06-17
Weakness: CWE-502

Description

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.

Affected products

Octopus Deploy Halibut: before 4.4.7 — fixed in 4.4.7

How to fix

Upgrade to a fixed version: Octopus Deploy Halibut 4.4.7. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html
https://advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html

Get alerted when CVE-2021-31819 or the next vulnerability affects your stack