Vulnerability record · CVE-2021-36163 · published 7 September 2021

CVE-2021-36163: Apache dubbo deserialization of untrusted data vulnerability

Apache · Dubbo

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1

9.8 CVSS 3.1 Critical EPSS 3.3% · top 12.1% CWE-502 · Deserialization of untrusted data

9.8CVSS 3.1 base score, v2 7.5

3.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Dubbo Apache

References

Link	Tags
https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org	Mailing ListVendor Advisory
https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org	Mailing ListVendor Advisory

Track CVE-2021-36163 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-29234Apache dubbo deserialization of untrusted data vulnerabilityA deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 throug…EPSS 7.4%15 Dec 2023 9.8CVE-2023-46279Apache dubbo deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the l…EPSS 1.7%15 Dec 2023 9.8CVE-2023-23638Apache dubbo deserialization of untrusted data vulnerabilityA deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.…EPSS 4.8%8 Mar 2023 9.8CVE-2021-32824Apache dubbo deserialization of untrusted data vulnerabilityApache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arb…EPSS 2.8%3 Jan 2023 9.8CVE-2022-39198Apache dubbo deserialization of untrusted data vulnerabilityA deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This iss…EPSS 2.6%18 Oct 2022 9.8CVE-2021-43297Apache dubbo deserialization of untrusted data vulnerabilityA deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dub…EPSS 17%10 Jan 2022 9.8CVE-2021-37579Apache dubbo deserialization of untrusted data vulnerabilityThe Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server.…EPSS 6.6%9 Sep 2021 9.8CVE-2021-36161Apache dubbo vulnerabilitySome component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean…EPSS 2.5%9 Sep 2021

Source: NIST National Vulnerability Database (record CVE-2021-36163), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.