{"id":"CVE-2019-17564","aliases":["EUVD-2022-2765","GHSA-69wp-3pm3-hxgg"],"status":"published","title":"Deserialization of Untrusted Data in Apache Dubbo","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.36513,"percentile":0.98503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2020-04-01T21:17:59Z","modified":"2026-10-24T10:30:37Z","exploits":[{"source":"nuclei","id":"CVE-2019-17564","title":"Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17564.yaml"},{"source":"pocgithub","id":"CyberCTF/vulhub-dubbo-cve-2019-17564","title":"CyberCTF/vulhub-dubbo-cve-2019-17564","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-dubbo-cve-2019-17564"},{"source":"pocgithub","id":"Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget","title":"Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget","date":"2020-02-20","url":"https://github.com/Dor-Tumarkin/CVE-2019-17564-FastJson-Gadget"},{"source":"pocgithub","id":"Exploit-3389/CVE-2019-17564","title":"Exploit-3389/CVE-2019-17564","date":"2020-02-17","url":"https://github.com/Exploit-3389/CVE-2019-17564"},{"source":"pocgithub","id":"Hu3sky/CVE-2019-17564","title":"Hu3sky/CVE-2019-17564","date":"2020-02-14","url":"https://github.com/Hu3sky/CVE-2019-17564"},{"source":"pocgithub","id":"Jaky5155/CVE-2019-17564","title":"Jaky5155/CVE-2019-17564","date":"2020-02-13","url":"https://github.com/Jaky5155/CVE-2019-17564"},{"source":"pocgithub","id":"fairyming/CVE-2019-17564","title":"fairyming/CVE-2019-17564","date":"2020-02-24","url":"https://github.com/fairyming/CVE-2019-17564"},{"source":"pocgithub","id":"r00t4dm/CVE-2019-17564","title":"r00t4dm/CVE-2019-17564","date":"2020-02-12","url":"https://github.com/r00t4dm/CVE-2019-17564"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.dubbo:dubbo-rpc-http-invoker","fixed_in":["2.7.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo-rpc-http-invoker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.7.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo-rpc-http-invoker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.7.5"}]}],"versions":["2.7.4","2.7.4.1"]}],"products":[{"vendor":"apache","product":"apache dubbo"},{"vendor":"apache","product":"dubbo"},{"vendor":"apache software foundation","product":"apache dubbo"}],"references":[{"url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4275","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17564","tags":["advisory"]},{"url":"https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b","tags":["web"]},{"url":"https://github.com/apache/dubbo/releases/tag/dubbo-2.7.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-69wp-3pm3-hxgg"}],"sources":{"cve":[{"id":"CVE-2019-17564","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2020-04-01T21:17:59Z","modified":"2024-08-05T01:40:15.977Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2022-2765","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2020-04-01T21:17:59Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-69wp-3pm3-hxgg","title":"Deserialization of Untrusted Data in Apache Dubbo","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2022-05-24T17:13:14Z","modified":"2023-02-02T05:04:14Z","cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:40.500292Z"}],"nvd":[{"id":"CVE-2019-17564","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2020-04-01T22:15:15.847Z","modified":"2026-06-17T02:24:10.123Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-17564","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2020-04-01T22:15:15.847Z","modified":"2026-10-24T10:30:37.174379244Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-69wp-3pm3-hxgg","title":"Deserialization of Untrusted Data in Apache Dubbo","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","status":"published","published":"2022-05-24T17:13:14Z","modified":"2024-12-05T05:26:00.128857Z","cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}