CVE-2021-30180: Apache Dubbo YAML tag routing enables arbitrary constructor calls

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a very high EPSS percentile, makes this a top remediation priority despite the absence of KEV listing.

What it is

Apache Dubbo before 2.7.9 parses YAML tag routing rules that can cause arbitrary constructors to be invoked. Because these rules are processed when customers make requests to locate endpoints, a malicious or tampered rule set can trigger unintended object instantiation inside the Dubbo process. The record gives no further detail on the exact constructor reachability or required preconditions.

Impact

An attacker who can influence the YAML routing rules could cause arbitrary constructors to run, potentially leading to code execution or full compromise of the Dubbo service. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached over the network through Dubbo's tag routing rule handling, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication or user interaction is required. The description does not specify whether the attacker must already be able to supply routing rules or whether a default configuration exposes this path.

Exploitation

CVE-2021-30180 is not listed in CISA KEV, but EPSS is high at roughly 0.60 probability (99th percentile), indicating elevated likelihood of exploitation activity. The only references are Apache mailing list advisories, with no public exploit or in-the-wild reporting noted in the record.

What to do

• Upgrade Apache Dubbo to 2.7.9 or later, which is the version boundary stated in the advisory.
• Restrict who can create or modify tag routing YAML rules and treat rule sources as trusted input.
• Disable or avoid tag routing if it is not required for your deployment.
• Monitor Dubbo configuration and rule repositories for unauthorized changes.
• Apply network controls so Dubbo endpoints are not reachable from untrusted networks.

Detection

• Alert on unexpected constructor or class-loading activity in Dubbo service logs and JVM telemetry.
• Monitor for changes to Dubbo tag routing YAML files or rule sources outside normal change windows.
• Hunt for Dubbo versions below 2.7.9 in asset inventories and correlate with external exposure.
• Review network logs for unusual inbound traffic to Dubbo service ports from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.