CVE-2022-39198

CVE-2022-39198: Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass

Vendor Apache Software Foundation
Product Apache Dubbo
Weakness CWE-502 · Unsafe deserialization
Published October 18, 2022
Last update May 13, 2025

CVSS base score

What the vulnerability does

Description

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.

Key dates

Disclosure timeline

October 18, 2022 CVE published
May 13, 2025 Record updated