{"id":"CVE-2019-17570","aliases":["DEBIAN-CVE-2019-17570","DLA-2078-1","DSA-4619-1","EUVD-2020-0468","GHSA-6vwp-35w3-xph8","MGASA-2020-0077","OESA-2022-1545","OESA-2022-2096","RHSA-2020:0310","UBUNTU-CVE-2019-17570","USN-4496-1"],"status":"published","title":"Insecure Deserialization in Apache XML-RPC","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.49285,"percentile":0.98898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2020-01-23T00:00:00Z","modified":"2026-08-18T01:17:26Z","exploits":[{"source":"pocgithub","id":"r00t4dm/CVE-2019-17570","title":"r00t4dm/CVE-2019-17570","date":"2020-01-19","url":"https://github.com/r00t4dm/CVE-2019-17570"},{"source":"pocgithub","id":"im23pds/xmlrpc-common-deserialization","title":"im23pds/xmlrpc-common-deserialization","date":"2020-01-26","url":"https://github.com/im23pds/xmlrpc-common-deserialization"}],"fixes":[{"ecosystem":"Debian:8","package":"libxmlrpc3-java","fixed_in":["3.1.3-7+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libxmlrpc3-java","fixed_in":["3.1.3-8+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libxmlrpc3-java","fixed_in":["3.1.3-9+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"xmlrpc","fixed_in":["3.1.3-73.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"xmlrpc","fixed_in":["3.1.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"xmlrpc","fixed_in":["3.1.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"xmlrpc","fixed_in":["3.1.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"xmlrpc","fixed_in":["3.1.3-2.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc","fixed_in":["1:3.1.3-8.17.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-client","fixed_in":["1:3.1.3-8.17.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-common","fixed_in":["1:3.1.3-8.17.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-javadoc","fixed_in":["1:3.1.3-8.17.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-server","fixed_in":["1:3.1.3-8.17.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc","fixed_in":["1:3.1.3-8.17.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-client","fixed_in":["1:3.1.3-8.17.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-common","fixed_in":["1:3.1.3-8.17.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-javadoc","fixed_in":["1:3.1.3-8.17.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-server","fixed_in":["1:3.1.3-8.17.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxmlrpc3-java","fixed_in":["3.1.3-7+deb8u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libxmlrpc3-java","fixed_in":["3.1.3-9+deb10u1build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.xmlrpc:xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-7+deb8u1"}]}],"versions":["3.1.3-7"]},{"source":"osv","ecosystem":"Debian:9","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8+deb9u1"}]}],"versions":["3.1.3-8"]},{"source":"osv","ecosystem":"Debian:10","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-9+deb10u1"}]}],"versions":["3.1.3-9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.xmlrpc:xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.3"}]}],"versions":["3.0","3.0b1","3.0rc1","3.1","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Mageia:7","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-73.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-2.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-java-common-xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-java-common-xmlrpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.3-8.17.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-7+deb8u1build0.16.04.1"}]}],"versions":["3.1.3-7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-9+deb10u1build0.18.04.1"}]}],"versions":["3.1.3-8","3.1.3-9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-7+deb8u1build0.16.04.1"}]}],"versions":["3.1.3-7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxmlrpc3-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-9+deb10u1build0.18.04.1"}]}],"versions":["3.1.3-8","3.1.3-9"]}],"products":[{"vendor":"apache","product":"apache xml-rpc"},{"vendor":"apache","product":"xml-rpc"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"software_collections"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-17570%3B","tags":["x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/846551673bbb7ec8d691008215384bcef03a3fb004d2da845cfe88ee%401390230951%40%3Cdev.ws.apache.org%3E","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/01/24/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00033.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0310","tags":["vendor-advisory","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4619","tags":["vendor-advisory","x_transferred","Third Party Advisory","web"]},{"url":"https://seclists.org/bugtraq/2020/Feb/8","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3QCRLJYQRGVTIYF4BXYRFSF3ONP3TBF/","tags":["vendor-advisory","x_transferred"]},{"url":"https://usn.ubuntu.com/4496-1/","tags":["vendor-advisory","x_transferred","Patch","Third Party Advisory"]},{"url":"https://github.com/orangecertcc/security-research/security/advisories/GHSA-x2r6-4m45-m4jp","tags":["x_transferred","Exploit","Third Party Advisory","web","article"]},{"url":"https://security.gentoo.org/glsa/202401-26","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17570","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-17570;","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3QCRLJYQRGVTIYF4BXYRFSF3ONP3TBF/"},{"url":"https://github.com/advisories/GHSA-6vwp-35w3-xph8"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3QCRLJYQRGVTIYF4BXYRFSF3ONP3TBF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3QCRLJYQRGVTIYF4BXYRFSF3ONP3TBF","tags":["web"]},{"url":"https://usn.ubuntu.com/4496-1","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26090","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1545","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2096","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775193","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0310.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17570","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-17570","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/01/16/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4496-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17570","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-01-23T00:00:00Z","modified":"2024-08-05T01:40:15.866Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2020-0468","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-01-23T00:00:00Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-6vwp-35w3-xph8","title":"Insecure Deserialization in Apache XML-RPC","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.\n\nApache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-06-10T20:02:39Z","modified":"2024-01-22T19:37:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2019-17570","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-01-23T22:15:10.2Z","modified":"2026-06-17T02:24:10.877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:05:42.416368Z"}],"osv":[{"id":"GHSA-6vwp-35w3-xph8","title":"Insecure Deserialization in Apache XML-RPC","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.\n\nApache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-06-10T20:02:39Z","modified":"2026-03-13T21:56:46.49215Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"OESA-2022-1545","title":"xmlrpc security update","description":"Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Apache XML-RPC was previously known as Helma XML-RPC. If you have code using the Helma library, all you should have to do is change the import statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*.\r\n\r\nSecurity Fix(es):\r\n\r\nAn untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.(CVE-2019-17570)","status":"published","published":"2022-03-07T11:04:49Z","modified":"2026-08-18T01:16:21.049662254Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2096","title":"xmlrpc security update","description":"Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Apache XML-RPC was previously known as Helma XML-RPC. If you have code using the Helma library, all you should have to do is change the import statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*.\r\n\r\nSecurity Fix(es):\r\n\r\nAn untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.(CVE-2019-17570)","status":"published","published":"2022-11-11T11:05:24Z","modified":"2026-08-18T01:17:26.873186585Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2020:0310","title":"Red Hat Security Advisory: rh-java-common-xmlrpc security update","status":"published","published":"2024-09-13T16:14:37Z","modified":"2026-06-29T10:28:40Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-17570","description":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.","status":"published","published":"2020-01-23T22:15:00Z","modified":"2026-02-04T03:43:51.95124Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-2078-1","title":"libxmlrpc3-java - security update","status":"published","published":"2020-01-27T00:00:00Z","modified":"2026-03-09T01:17:52.209799Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4619-1","title":"libxmlrpc3-java - security update","status":"published","published":"2020-02-06T00:00:00Z","modified":"2026-03-09T02:08:36.386973Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0077","title":"Updated xmlrpc packages fix security vulnerability","description":"A flaw was discovered where the XMLRPC client implementation in Apache\nXMLRPC, performed deserialization of the server-side exception serialized\nin the faultCause attribute of XMLRPC error response messages. A malicious\nor compromised XMLRPC server could possibly use this flaw to execute\narbitrary code with the privileges of an application using the Apache XMLRPC\nclient library (CVE-2019-17570).\n","status":"published","published":"2020-02-09T19:13:40Z","modified":"2026-04-16T04:43:45.172991011Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-4496-1","title":"Apache XML-RPC vulnerability","description":"It was discovered that Apache XML-RPC (aka ws-xmlrpc) does not properly \ndeserialize untrusted data. An attacker could possibly use this issue to \nexecute arbitrary code. (CVE-2019-17570)\n","status":"published","published":"2020-09-15T17:25:59Z","modified":"2026-02-10T04:41:55Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}