CVE-2023-23638
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
CVE-2023-23638- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2023-0956
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
EUVD-2023-0956- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-933g-v89r-x8pf
Apache Dubbo vulnerable to Deserialization of Untrusted Data
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
GHSA-933g-v89r-x8pf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
CVE-2023-23638- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
CVE-2023-23638- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-933g-v89r-x8pf
Apache Dubbo vulnerable to Deserialization of Untrusted Data
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
- Record
GHSA-933g-v89r-x8pf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.dubbo:dubboMaven |
before 2.7.21 | 2.7.21 |
org.apache.dubbo:dubboMaven |
3.0.0 up to 3.0.13 | 3.0.13 |
org.apache.dubbo:dubboMaven |
3.1.0 up to 3.1.5 | 3.1.5 |
org.apache.dubbo:dubboMaven |
before 2.7.22, plus listed versions 2.7.02.7.12.7.102.7.112.7.12 Show 18 moreShow less2.7.132.7.142.7.152.7.162.7.172.7.182.7.192.7.22.7.202.7.212.7.32.7.42.7.4.12.7.52.7.62.7.72.7.82.7.9 |
2.7.22 |
org.apache.dubbo:dubboMaven |
3.0.0 up to 3.0.13, plus listed versions 3.0.0.preview3.0.13.0.103.0.113.0.12 Show 9 moreShow less3.0.23.0.2.13.0.33.0.43.0.53.0.63.0.73.0.83.0.9 |
3.0.13 |
org.apache.dubbo:dubboMaven |
3.1.0 up to 3.1.5, plus listed versions 3.1.13.1.23.1.33.1.4 |
3.1.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | P4x1s/CVE-2023-23638-Tools | 2023-06-08 |
| PoC in GitHub | X1r0z/dubbo-rce | 2023-03-22 |
| PoC in GitHub | YYHYlh/Apache-Dubbo-CVE-2023-23638-exp | 2023-05-11 |
| PoC in GitHub | cuijiung/dubbo-CVE-2023-23638 | 2025-07-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-23638 is a medium vulnerability (CVSS 5.0) in Apache Dubbo, published March 8, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.89%, the 92nd percentile. Fixed in org.apache.dubbo:dubbo 2.7.21.