CVE-2026-4735: A stack overflow and DoS vulnerability in DTStack/chunjun

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-24 · updated 2026-06-17
Weakness: CWE-502

Description

Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java. This issue affects chunjun: before 1.16.1.

Affected products

DTStack chunjun: all versions

References

https://github.com/DTStack/chunjun/pull/1939

Get alerted when CVE-2026-4735 or the next vulnerability affects your stack