{"id":"CVE-2019-17564","aliases":["GHSA-69wp-3pm3-hxgg"],"url":"https://o3.security/vulnerability/CVE-2019-17564","summary":"Deserialization of Untrusted Data in Apache Dubbo","details":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","published":"2020-04-01T22:15:15.847Z","modified":"2026-10-24T10:30:37.174379244Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.36513,"percentile":0.9842,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":8,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo-rpc-http-invoker","fixedVersion":"2.7.5"}],"fix":{"url":"https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b","label":"apache/dubbo@9b18fe2"},"references":[{"type":"ADVISORY","url":"https://advisory.checkmarx.net/advisory/CX-2020-4275"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17564"},{"type":"WEB","url":"https://github.com/apache/dubbo/commit/9b18fe228971eaeca9b87d7b7e95df1c2a8ff91b"},{"type":"WEB","url":"https://github.com/apache/dubbo/releases/tag/dubbo-2.7.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:37.174379244Z"}}