org.apache.dubbo:dubbo (Maven)
Advisories
26
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.2.5 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.dubbo</groupId><artifactId>dubbo</artifactId><version>3.2.5</version></dependency>gradle
implementation("org.apache.dubbo:dubbo:3.2.5")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-97rv-88gf-phvr Apache Dubbo: Bypass deny serialize list check in Apache Dubbo |
Critical EPSS 1.67% |
>= 3.1.5, < 3.1.6 | 3.1.6 |
| GHSA-6x49-w35h-wqrj Bypass serialize checks in Apache Dubbo |
Critical EPSS 7.40% |
>= 3.1.0, < 3.1.11 | 3.1.11 |
| GHSA-6x49-w35h-wqrj Bypass serialize checks in Apache Dubbo |
Critical EPSS 7.40% |
>= 3.2.0, < 3.2.5 | 3.2.5 |
| GHSA-933g-v89r-x8pf Apache Dubbo vulnerable to Deserialization of Untrusted Data |
Critical EPSS 4.85% |
>= 3.1.0, < 3.1.5 | 3.1.5 |
| GHSA-933g-v89r-x8pf Apache Dubbo vulnerable to Deserialization of Untrusted Data |
Critical EPSS 4.85% |
< 2.7.22 | 2.7.22 |
| GHSA-933g-v89r-x8pf Apache Dubbo vulnerable to Deserialization of Untrusted Data |
Critical EPSS 4.85% |
>= 3.0.0, < 3.0.13 | 3.0.13 |
| GHSA-5qwq-g2hx-r6f7 Hessian Lite for Apache Dubbo deserialization vulnerability |
Critical EPSS 3.28% |
>= 3.1.0, < 3.1.1 | 3.1.1 |
| GHSA-5qwq-g2hx-r6f7 Hessian Lite for Apache Dubbo deserialization vulnerability |
Critical EPSS 3.28% |
>= 3.0.0, < 3.0.12 | 3.0.12 |
| GHSA-5qwq-g2hx-r6f7 Hessian Lite for Apache Dubbo deserialization vulnerability |
Critical EPSS 3.28% |
>= 2.7.0, < 2.7.18 | 2.7.18 |
| GHSA-gm48-83x4-84jg Server-side request forgery in Apache Dubbo |
Medium EPSS 1.86% |
>= 2.5.0, < 2.7.15 | 2.7.15 |
| GHSA-7wfc-x4f7-gg2x Code injection in Apache Dubbo |
Critical EPSS 60.28% |
>= 2.7.0, < 2.7.10 | 2.7.10 |
| GHSA-5mc7-m686-p6jg Deserialization of Untrusted Data in Apache Dubbo |
Critical EPSS 4.08% |
>= 2.5.0, < 2.7.10 | 2.7.10 |
| GHSA-qmfc-6www-fjqw Code injection in Apache Dubbo |
Critical EPSS 60.86% |
>= 2.5.0, < 2.7.10 | 2.7.10 |
| GHSA-gw4j-4229-q4px Server-Side Request Forgery in Apache Dubbo |
Medium EPSS 2.07% |
>= 2.5.0, < 2.7.10 | 2.7.10 |
| GHSA-v2rg-8cwr-75g8 Deserializer tampering in Apache Dubbo |
Critical EPSS 21.22% |
>= 2.5.0, < 2.7.8 | 2.7.8 |
| GHSA-whww-v56c-cgv2 Deserialization of Untrusted Data in Apache Dubbo |
Critical EPSS 16.44% |
< 2.7.7 | 2.7.7 |
| GHSA-vp5x-3v8r-qprw Deserialization of Untrusted Data in Dubbo |
Critical EPSS 16.53% |
>= 2.7.0, < 2.7.15 | 2.7.15 |
| GHSA-vp5x-3v8r-qprw Deserialization of Untrusted Data in Dubbo |
Critical EPSS 16.53% |
>= 3.0.0, < 3.0.5 | 3.0.5 |
| GHSA-vp5x-3v8r-qprw Deserialization of Untrusted Data in Dubbo |
Critical EPSS 16.53% |
>= 2.6.0, < 2.6.12 | 2.6.12 |
| GHSA-q897-9jxf-jg9r Security check skip in Apache Dubbo |
Critical EPSS 6.56% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-q897-9jxf-jg9r Security check skip in Apache Dubbo |
Critical EPSS 6.56% |
< 2.7.13 | 2.7.13 |
| GHSA-qvm7-23cj-437v Remote Code Execution in Apache Dubbo |
Critical EPSS 2.47% |
< 2.7.13 | 2.7.13 |
| GHSA-r577-4hq7-73qh Remote Code Execution in Apache Dubbo |
High EPSS 2.26% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-r577-4hq7-73qh Remote Code Execution in Apache Dubbo |
High EPSS 2.26% |
< 2.7.13 | 2.7.13 |
| GHSA-cpx9-4rwv-486v Hessian protocol configuration vulnerability in Apache Dubbo |
Critical EPSS 3.25% |
>= 2.7.0, < 2.7.13 | 2.7.13 |
| GHSA-cpx9-4rwv-486v Hessian protocol configuration vulnerability in Apache Dubbo |
Critical EPSS 3.25% |
< 2.6.10.1 | 2.6.10.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor