Read the docs
TI-2019-06668 Aliases CVE-2019-9212GHSA-pfwp-8pq4-g7pv

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a…

Priority MEDIUM 47CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated

Why it matters now

EPSS 0.02763 86th percentileScored 2026-11-07
Fix Fixed com.alipay.sofa:hessian (Maven): 4.0.2, 3.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.alipay.sofa:hessian (Maven)4.0.0 to before 4.0.24.0.2Patch availableGHSA-pfwp-8pq4-g7pv
—com.alipay.sofa:hessian (Maven)before 3.3.63.3.6Patch availableGHSA-pfwp-8pq4-g7pv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.alipay.sofa:hessian (Maven) Vendor— Affected 4.0.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-pfwp-8pq4-g7pv
  • com.alipay.sofa:hessian (Maven) Vendor— Affected before 3.3.6 Fixed in 3.3.6 Patch available GHSA-pfwp-8pq4-g7pv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:antfin:sofa-hessian:*:*:*:*:*:*:*:*up to 4.0.2VulnerableAntfin
  • cpe:2.3:a:antfin:sofa-hessian:*:*:*:*:*:*:*:* Versions up to 4.0.2 Vulnerable ·Antfin

Remediation

  • Fix · GHSA-pfwp-8pq4-g7pv com.alipay.sofa:hessian (Maven) Fixed in 4.0.2 Advisory →
  • Fix · GHSA-pfwp-8pq4-g7pv com.alipay.sofa:hessian (Maven) Fixed in 3.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9212
  2. 2026-10-03 Alias added: GHSA-pfwp-8pq4-g7pv

References

Patch 1

Advisory 2

Other 1

  • TI-2024-31372 Remote Command Execution(RCE) Vulnerbility in sofa-hessian CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences