Read the docs
TI-2021-07773 Aliases CVE-2021-25640GHSA-gw4j-4229-q4px

Open Redirect or SSRF vulnerability usage of parseURL

Priority LOW 31CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.

Why it matters now

EPSS 0.02073 81st percentileScored 2026-11-07
Fix Fixed Apache Dubbo (Apache Software Foundation): 2.7.9, 2.6.9org.apache.dubbo:dubbo (Maven): 2.7.10+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache DubboApache Dubbo 2.7.x to before 2.7.9; Apache Dubbo 2.6.x to before 2.6.92.7.9, 2.6.9Patch availableCNA
—org.apache.dubbo:dubbo (Maven)2.5.0 to before 2.7.102.7.10Patch availableGHSA-gw4j-4229-q4px
—com.alibaba:dubbo (Maven)2.5.0 to before 2.6.92.6.9Patch availableGHSA-gw4j-4229-q4px
  • Apache Dubbo VendorApache Affected Apache Dubbo 2.7.x to before 2.7.9; Apache Dubbo 2.6.x to before 2.6.9 Fixed in 2.7.9, 2.6.9 Patch available CNA
  • org.apache.dubbo:dubbo (Maven) Vendor— Affected 2.5.0 to before 2.7.10 Fixed in 2.7.10 Patch available GHSA-gw4j-4229-q4px
  • com.alibaba:dubbo (Maven) Vendor— Affected 2.5.0 to before 2.6.9 Fixed in 2.6.9 Patch available GHSA-gw4j-4229-q4px

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*2.5.0 to before 2.6.9; 2.7.0 to before 2.7.9VulnerableApache
  • cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.6.9; 2.7.0 to before 2.7.9 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Dubbo (Apache Software Foundation) Fixed in 2.7.9, 2.6.9
  • Fix · GHSA-gw4j-4229-q4px org.apache.dubbo:dubbo (Maven) Fixed in 2.7.10 Advisory →
  • Fix · GHSA-gw4j-4229-q4px com.alibaba:dubbo (Maven) Fixed in 2.6.9 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Dubbo 2.6.9, 2.7.9

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-10719 Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filterPriority MEDIUM 49
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25640
  2. 2026-10-03 Alias added: GHSA-gw4j-4229-q4px

References

Advisory 2

Other 1

  • TI-2021-12489 Regular expression Denial of Service in MooTools CVSS 3.1CRITICAL 9.8
  • TI-2021-10721 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) CVSS 3.1CRITICAL 9.8
  • TI-2021-10720 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) CVSS 3.1CRITICAL 9.8
  • TI-2019-13107 Deserialization of untrusted data in Apache Dubbo CVSS 3.1CRITICAL 9.8
  • TI-2021-07774 Dubbo Zookeeper does not check serialization id CVSS 3.1CRITICAL 9.8
  • TI-2021-19290 Dubbo Hessian cause RCE when parse error CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences