What’s Vulnerable › Vulnerabilities

CVE-2021-40146: A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-11 · updated 2026-06-17

Description

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.

Affected products

• Apache Software Foundation Apache Any23: before 2.5 — fixed in 2.5

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Any23 2.5. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/09/11/2
• https://lists.apache.org/thread.html/r7c521ed85c7ae1bad4fdf95b459f2aaa8a67eae338636b7b7ec35d86%40%3Cannounce.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/09/11/2
• https://lists.apache.org/thread.html/r7c521ed85c7ae1bad4fdf95b459f2aaa8a67eae338636b7b7ec35d86%40%3Cannounce.apache.org%3E

Get alerted when CVE-2021-40146 or the next vulnerability affects your stack