{"id":"CVE-2022-39198","aliases":["EUVD-2022-7031","GHSA-5qwq-g2hx-r6f7"],"status":"published","title":"Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03308,"percentile":0.88707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2022-10-18T00:00:00Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Maven","package":"com.alibaba:hessian-lite","fixed_in":["3.2.13"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.dubbo:dubbo","fixed_in":["2.7.18","3.0.12","3.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.alibaba:hessian-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.12"},{"fixed":"3.2.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.7.17"},{"fixed":"2.7.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.11"},{"fixed":"3.0.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"fixed":"3.1.1"}]}],"versions":["3.1.0"]},{"source":"osv","ecosystem":"Maven","package":"com.alibaba:hessian-lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.13"}]}],"versions":["2.6.2","3.2.10","3.2.11","3.2.12","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.18"}]}],"versions":["2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.2","2.7.3","2.7.4","2.7.4.1","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.12"}]}],"versions":["3.0.0","3.0.0.preview","3.0.1","3.0.10","3.0.11","3.0.2","3.0.2.1","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.1"}]}],"versions":["3.1.0"]}],"products":[{"vendor":"apache","product":"dubbo"},{"vendor":"apache software foundation","product":"apache dubbo"}],"references":[{"url":"https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkk","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39198","tags":["advisory"]},{"url":"https://github.com/apache/dubbo-hessian-lite/releases/tag/v3.2.13","tags":["web"]},{"url":"https://github.com/apache/dubbo/releases/tag/dubbo-2.7.18","tags":["web"]},{"url":"https://github.com/apache/dubbo/releases/tag/dubbo-3.0.12","tags":["web"]},{"url":"https://github.com/apache/dubbo/releases/tag/dubbo-3.1.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5qwq-g2hx-r6f7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39198.json","tags":["advisory"]},{"url":"https://github.com/apache/dubbo-hessian-lite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-39198","title":"Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2025-05-13T14:48:42.604Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-7031","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2025-05-13T14:48:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:48.910403Z"}],"ghsa":[{"id":"GHSA-5qwq-g2hx-r6f7","title":"Hessian Lite for Apache Dubbo deserialization vulnerability","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-19T12:00:22Z","modified":"2023-02-01T05:08:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:39.76883Z"}],"nvd":[{"id":"CVE-2022-39198","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-18T19:15:10.213Z","modified":"2026-06-17T04:57:53.88Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"CVE-2022-39198","title":"Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2026-10-28T02:30:21.395019721Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-5qwq-g2hx-r6f7","title":"Hessian Lite for Apache Dubbo deserialization vulnerability","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.","status":"published","published":"2022-10-19T12:00:22Z","modified":"2023-11-08T04:10:14.627608Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:38.553953Z"}]}}