TI-2021-12489 CVE-2021-32824 · GHSA-fprr-rrm8-4534
Regular expression Denial of Service in MooTools
Priority HIGH 82
Apache Dubbo is a java based, open source RPC framework.
Apache
Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9
Exploited now
Apache records in CISA KEVTI-2026-79288 Google Brotli Unchecked Return Value Vulnerability TI-2016-02580 Apache Struts Command Injection Vulnerability TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
19 records in Dubbo · all components
TI-2021-10721 CVE-2021-30181 · GHSA-qmfc-6www-fjqw
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Priority HIGH 77
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server.
TI-2021-10720 CVE-2021-30180 · GHSA-7wfc-x4f7-gg2x
Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
Priority HIGH 76
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server.
TI-2019-13107 CVE-2019-17564 · GHSA-69wp-3pm3-hxgg
Deserialization of untrusted data in Apache Dubbo
Priority HIGH 68
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.
TI-2021-07774 CVE-2021-25641 · GHSA-v2rg-8cwr-75g8
Dubbo Zookeeper does not check serialization id
Priority MEDIUM 61
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on.
TI-2021-19290 CVE-2021-43297 · GHSA-vp5x-3v8r-qprw
Dubbo Hessian cause RCE when parse error
Priority MEDIUM 59
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution.
TI-2020-01872 CVE-2020-1948 · GHSA-whww-v56c-cgv2
Deserialization of untrusted data in Apache Dubbo
Priority MEDIUM 59
This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower.
TI-2022-18578 CVE-2022-39198 · GHSA-5qwq-g2hx-r6f7
Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
Priority MEDIUM 55
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution.
TI-2023-13646 CVE-2023-29234 · GHSA-6x49-w35h-wqrj
Bypass serialize checks in Apache Dubbo
Priority MEDIUM 52
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.
TI-2021-15466 CVE-2021-37579 · GHSA-q897-9jxf-jg9r
Bypass deserialization checks in Apache Dubbo
Priority MEDIUM 51
The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server.
TI-2020-09654 CVE-2020-11995 · GHSA-74mg-6xqx-2vrq
Apache Dubbo default deserialization protocol Hessian2 cause CRE
Priority MEDIUM 51
A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution.
TI-2023-09466 CVE-2023-23638 · GHSA-933g-v89r-x8pf
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
Priority MEDIUM 50
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
TI-2021-10719 CVE-2021-30179 · GHSA-5mc7-m686-p6jg
Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
Priority MEDIUM 49
Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces.
TI-2021-14582 CVE-2021-36163 · GHSA-cpx9-4rwv-486v
Unsafe deserialization in providers using the Hessian protocol
Priority MEDIUM 48
In Apache Dubbo, users may choose to use the Hessian protocol.
TI-2021-14580 CVE-2021-36161 · GHSA-qvm7-23cj-437v
Unprotected input value toString cause RCE
Priority MEDIUM 47
Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method.
TI-2023-24900 CVE-2023-46279 · GHSA-97rv-88gf-phvr
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
Priority MEDIUM 45
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.
TI-2021-14581 CVE-2021-36162 · GHSA-r577-4hq7-73qh
Unprotected yaml deserialization cause RCE
Priority MEDIUM 42
Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo).
TI-2022-08764 CVE-2022-24969 · GHSA-gm48-83x4-84jg
bypass of CVE-2021-25640
Priority LOW 31
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
TI-2021-07773 CVE-2021-25640 · GHSA-gw4j-4229-q4px
Open Redirect or SSRF vulnerability usage of parseURL
Priority LOW 31
In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.