Read the docs
TI-2020-09654 Aliases CVE-2020-11995GHSA-74mg-6xqx-2vrq

Apache Dubbo default deserialization protocol Hessian2 cause CRE

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.

Why it matters now

EPSS 0.05926 93rd percentileScored 2026-11-07
Fix Fixed Apache Dubbo (Apache Software Foundation): 2.6.9org.apache.dubbo:dubbo-parent (Maven): 2.7.8, 2.6.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DubboApache Dubbo to before 2.6.92.6.9Patch availableCNA
—org.apache.dubbo:dubbo-parent (Maven)2.7.0 to before 2.7.82.7.8Patch availableGHSA-74mg-6xqx-2vrq
—org.apache.dubbo:dubbo-parent (Maven)before 2.6.92.6.9Patch availableGHSA-74mg-6xqx-2vrq
  • Apache Dubbo VendorApache Affected Apache Dubbo to before 2.6.9 Fixed in 2.6.9 Patch available CNA
  • org.apache.dubbo:dubbo-parent (Maven) Vendor— Affected 2.7.0 to before 2.7.8 Fixed in 2.7.8 Patch available GHSA-74mg-6xqx-2vrq
  • org.apache.dubbo:dubbo-parent (Maven) Vendor— Affected before 2.6.9 Fixed in 2.6.9 Patch available GHSA-74mg-6xqx-2vrq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*2.5.0 – 2.5.10; 2.6.0 – 2.6.8; 2.7.0 – 2.7.7VulnerableApache
  • cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:* Versions 2.5.0 – 2.5.10; 2.6.0 – 2.6.8; 2.7.0 – 2.7.7 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Dubbo (Apache Software Foundation) Fixed in 2.6.9
  • Fix · GHSA-74mg-6xqx-2vrq org.apache.dubbo:dubbo-parent (Maven) Fixed in 2.7.8 Advisory →
  • Fix · GHSA-74mg-6xqx-2vrq org.apache.dubbo:dubbo-parent (Maven) Fixed in 2.6.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11995
  2. 2026-10-03 Alias added: GHSA-74mg-6xqx-2vrq

References

Advisory 2

Other 1

  • TI-2021-12489 Regular expression Denial of Service in MooTools CVSS 3.1CRITICAL 9.8
  • TI-2021-10721 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVSS 3.1CRITICAL 9.8
  • TI-2021-10720 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVSS 3.1CRITICAL 9.8
  • TI-2019-13107 Deserialization of untrusted data in Apache Dubbo CVSS 3.1CRITICAL 9.8
  • TI-2021-07774 Dubbo Zookeeper does not check serialization id CVSS 3.1CRITICAL 9.8
  • TI-2021-19290 Dubbo Hessian cause RCE when parse error CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences