CVE-2019-17570: Apache XML-RPC untrusted deserialization in XmlRpcResponseParser

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 9.8 and a very high EPSS percentile with a public exploit reference make this serious, but it requires the client to connect to an attacker-controlled server and upstream will not fix it, so exposure depends on deployment.

What it is

Apache XML-RPC (ws-xmlrpc) deserializes untrusted data in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method. A malicious XML-RPC server can send a crafted response that causes a connecting XML-RPC client to execute arbitrary code. Apache XML-RPC is no longer maintained and the project states this issue will not be fixed.

Impact

An attacker controlling the XML-RPC server side gains remote code execution on the client host, with full loss of confidentiality, integrity and availability per the CVSS vector. This is a client-side compromise triggered by the server, reversing the usual trust direction.

Attack surface

Reached over the network (AV:N) with no authentication and no user interaction (PR:N, UI:N); the client only needs to issue a request to an attacker-controlled or compromised XML-RPC endpoint. Any application embedding the ws-xmlrpc client library is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.49285 (98.8th percentile) and a public exploit advisory reference is tagged Exploit. No ransomware usage is documented.

What to do

• Patch where vendor fixes exist: apply Red Hat RHSA-2020:0310, Ubuntu USN-4496-1, Debian DSA-4619, or the Fedora and Gentoo advisories for the packaged xmlrpc library.
• Where no fix is available, stop using Apache XML-RPC as a client against untrusted or third-party endpoints, since upstream is unmaintained and will not fix it.
• Replace the ws-xmlrpc client with a maintained XML-RPC or HTTP library, or restrict client connections to explicitly allowlisted server hosts.
• If the library must stay, run the client with least privilege and network egress restrictions so a deserialization payload cannot reach useful targets.
• Inventory applications and dependencies that bundle ws-xmlrpc, including Java services and OS packages, to find unpatched instances.

Detection

• Search dependency manifests, SBOMs and installed packages for org.apache.xmlrpc / ws-xmlrpc and flag versions without a vendor patch.
• Monitor XML-RPC client processes for unexpected child process creation or outbound connections to unfamiliar servers, which would indicate post-exploitation activity.
• Alert on XML-RPC responses containing serialized Java object markers or unusually large or malformed payloads returned to client code.
• Review egress logs for XML-RPC clients contacting hosts outside the approved server allowlist.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.