Every CVE Search/ Get API key

CVE-2019-17570

Insecure Deserialization in Apache XML-RPC

9.8 CriticalPublic exploitFix available

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

49.3%Up 15.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
CVE-2019-17570
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
CVE-2019-17570
Updated
2026-11-02
EUVDEUVD-2020-0468 No score

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
EUVD-2020-0468
Updated
2026-11-03
GitHub AdvisoriesGHSA-6vwp-35w3-xph8 9.8

Insecure Deserialization in Apache XML-RPC

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
GHSA-6vwp-35w3-xph8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVGHSA-6vwp-35w3-xph8 9.8

Insecure Deserialization in Apache XML-RPC

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
GHSA-6vwp-35w3-xph8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVOESA-2022-1545 9.8

xmlrpc security update

Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Apache XML-RPC was previously known as Helma XML-RPC. If you have code using the Helma library, all you should have to do is change the import statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*.

Security Fix(es):

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.(CVE-2019-17570)

Record
OESA-2022-1545
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2022-2096 9.8

xmlrpc security update

Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Apache XML-RPC was previously known as Helma XML-RPC. If you have code using the Helma library, all you should have to do is change the import statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*.

Security Fix(es):

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.(CVE-2019-17570)

Record
OESA-2022-2096
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:0310 9.8

Red Hat Security Advisory: rh-java-common-xmlrpc security update

Record
RHSA-2020:0310
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-17570 9.8

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

Record
UBUNTU-CVE-2019-17570
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2020-0077 No score

Updated xmlrpc packages fix security vulnerability

A flaw was discovered where the XMLRPC client implementation in Apache XMLRPC, performed deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious or compromised XMLRPC server could possibly use this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library (CVE-2019-17570).

Record
MGASA-2020-0077
Updated
2026-11-02
OSVUSN-4496-1 No score

Apache XML-RPC vulnerability

It was discovered that Apache XML-RPC (aka ws-xmlrpc) does not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-17570)

Record
USN-4496-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.xmlrpc:xmlrpc
Maven
 through 3.1.3 None known
libxmlrpc3-java
Debian:8
 before 3.1.3-7+deb8u1, plus listed versions
3.1.3-7
3.1.3-7+deb8u1
libxmlrpc3-java
Debian:9
 before 3.1.3-8+deb9u1, plus listed versions
3.1.3-8
3.1.3-8+deb9u1
libxmlrpc3-java
Debian:10
 before 3.1.3-9+deb10u1, plus listed versions
3.1.3-9
3.1.3-9+deb10u1
org.apache.xmlrpc:xmlrpc
Maven
 through 3.1.3, plus listed versions
3.03.0b13.0rc13.13.1.13.1.2
 None known
xmlrpc
Mageia:7
 before 3.1.3-73.1.mga7
3.1.3-73.1.mga7
xmlrpc
openEuler:20.03-LTS-SP1
 before 3.1.3-2.oe1
3.1.3-2.oe1
xmlrpc
openEuler:20.03-LTS-SP2
 before 3.1.3-2.oe1
3.1.3-2.oe1
xmlrpc
openEuler:20.03-LTS-SP3
 before 3.1.3-2.oe1
3.1.3-2.oe1
xmlrpc
openEuler:22.03-LTS
 before 3.1.3-2.oe2203
3.1.3-2.oe2203
Show 12 moreShow less
Affected packages
PackageAffectedFixed
rh-java-common-xmlrpc
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.17.el6
1:3.1.3-8.17.el6
rh-java-common-xmlrpc-client
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.17.el6
1:3.1.3-8.17.el6
rh-java-common-xmlrpc-common
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.17.el6
1:3.1.3-8.17.el6
rh-java-common-xmlrpc-javadoc
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.17.el6
1:3.1.3-8.17.el6
rh-java-common-xmlrpc-server
Red Hat:rhel_software_collections:3::el6
 before 1:3.1.3-8.17.el6
1:3.1.3-8.17.el6
rh-java-common-xmlrpc
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.17.el7
1:3.1.3-8.17.el7
rh-java-common-xmlrpc-client
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.17.el7
1:3.1.3-8.17.el7
rh-java-common-xmlrpc-common
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.17.el7
1:3.1.3-8.17.el7
rh-java-common-xmlrpc-javadoc
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.17.el7
1:3.1.3-8.17.el7
rh-java-common-xmlrpc-server
Red Hat:rhel_software_collections:3::el7
 before 1:3.1.3-8.17.el7
1:3.1.3-8.17.el7
libxmlrpc3-java
Ubuntu:16.04:LTS
 before 3.1.3-7+deb8u1build0.16.04.1, plus listed versions
3.1.3-7
3.1.3-7+deb8u1build0.16.04.1
libxmlrpc3-java
Ubuntu:18.04:LTS
 before 3.1.3-9+deb10u1build0.18.04.1, plus listed versions
3.1.3-83.1.3-9
3.1.3-9+deb10u1build0.18.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubim23pds/xmlrpc-common-deserialization2020-01-26
PoC in GitHubr00t4dm/CVE-2019-175702020-01-19

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17570 is a critical vulnerability (CVSS 9.8) in Apache Xml-rpc, published January 23, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 49.3%, the 98th percentile. Fixed in libxmlrpc3-java 3.1.3-7+deb8u1.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open