{"id":"CVE-2019-17564","aliases":["GHSA-69wp-3pm3-hxgg"],"url":"https://o3.security/vulnerability/CVE-2019-17564","summary":"Deserialization of Untrusted Data in Apache Dubbo","details":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","published":"2020-04-01T22:15:15.847Z","modified":"2026-07-08T19:02:35.712793Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.36513,"percentile":0.9842,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":8,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo-rpc-http-invoker","fixedVersion":"2.7.5"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://advisory.checkmarx.net/advisory/CX-2020-4275"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T19:02:35.712793Z"}}