{"id":"CVE-2023-23638","aliases":["EUVD-2023-0956","GHSA-933g-v89r-x8pf"],"status":"published","title":"Apache Dubbo Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04887,"percentile":0.92144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2023-03-08T10:48:58Z","modified":"2026-10-28T02:30:52Z","exploits":[{"source":"pocgithub","id":"P4x1s/CVE-2023-23638-Tools","title":"P4x1s/CVE-2023-23638-Tools","date":"2023-06-08","url":"https://github.com/P4x1s/CVE-2023-23638-Tools"},{"source":"pocgithub","id":"X1r0z/dubbo-rce","title":"X1r0z/dubbo-rce","date":"2023-03-22","url":"https://github.com/X1r0z/dubbo-rce"},{"source":"pocgithub","id":"YYHYlh/Apache-Dubbo-CVE-2023-23638-exp","title":"YYHYlh/Apache-Dubbo-CVE-2023-23638-exp","date":"2023-05-11","url":"https://github.com/YYHYlh/Apache-Dubbo-CVE-2023-23638-exp"},{"source":"pocgithub","id":"cuijiung/dubbo-CVE-2023-23638","title":"cuijiung/dubbo-CVE-2023-23638","date":"2025-07-11","url":"https://github.com/cuijiung/dubbo-CVE-2023-23638"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.dubbo:dubbo","fixed_in":["2.7.21","3.0.13","3.1.5","2.7.22"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.22"}]}],"versions":["2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.19","2.7.2","2.7.20","2.7.21","2.7.3","2.7.4","2.7.4.1","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.13"}]}],"versions":["3.0.0","3.0.0.preview","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.2.1","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dubbo:dubbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.5"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3","3.1.4"]}],"products":[{"vendor":"apache","product":"dubbo"},{"vendor":"apache software foundation","product":"apache dubbo"}],"references":[{"url":"https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb","tags":["vendor-advisory","x_transferred","Issue Tracking","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23638","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-933g-v89r-x8pf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23638.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-23638","title":"Apache Dubbo Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. ","status":"published","published":"2023-03-08T10:48:58.574Z","modified":"2024-10-23T16:41:29.622Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-0956","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. ","status":"published","published":"2023-03-08T10:48:58Z","modified":"2024-10-23T16:41:29Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:21.011532Z"}],"ghsa":[{"id":"GHSA-933g-v89r-x8pf","title":"Apache Dubbo vulnerable to Deserialization of Untrusted Data","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.","status":"published","published":"2023-03-08T12:30:16Z","modified":"2023-03-17T18:28:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:48.041653Z"}],"nvd":[{"id":"CVE-2023-23638","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. ","status":"published","published":"2023-03-08T11:15:10.39Z","modified":"2026-06-17T05:37:38.76Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-23638","title":"Apache Dubbo Deserialization Vulnerability Gadgets Bypass","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. \n\nThis issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. ","status":"published","published":"2023-03-08T10:48:58.574Z","modified":"2026-10-28T02:30:52.577363753Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-933g-v89r-x8pf","title":"Apache Dubbo vulnerable to Deserialization of Untrusted Data","description":"A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.","status":"published","published":"2023-03-08T12:30:16Z","modified":"2023-11-08T04:11:42.041801Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}