Cxc

**Name of the Vulnerable Software and Affected Versions** Apache Dubbo versions 2.7.21 and prior versions Apache Dubbo versions 3.0.13 and prior versions Apache Dubbo versions 3.1.5 and prior versions **Description** A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. The issue is related to the mechanism of deserialization in the Apache Dubbo RPC framework, allowing a remote attacker to execute arbitrary code. **Recommendations** For Apache Dubbo versions 2.7.21 and prior versions, update to a version later than 2.7.21. For Apache Dubbo versions 3.0.13 and prior versions, update to a version later than 3.0.13. For Apache Dubbo versions 3.1.5 and prior versions, update to a version later than 3.1.5. As a temporary workaround, consider disabling the dubbo generic invoke functionality until a patch is available. Restrict access to the vulnerable RPC endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Dubbo versions 2.7.17 and prior Apache Dubbo versions 3.0.11 and prior Apache Dubbo versions 3.1.0 and prior dubbo hessian-lite versions 3.2.12 and earlier **Description** A deserialization vulnerability existed in dubbo hessian-lite, which could lead to malicious code execution. **Recommendations** For Apache Dubbo versions 2.7.17 and prior, update to a version later than 2.7.17. For Apache Dubbo versions 3.0.11 and prior, update to a version later than 3.0.11. For Apache Dubbo versions 3.1.0 and prior, update to a version later than 3.1.0. For dubbo hessian-lite versions 3.2.12 and earlier, update to a version later than 3.2.12.

**Name of the Vulnerable Software and Affected Versions** Apache Dubbo versions prior to 2.6.12 Apache Dubbo versions prior to 2.7.15 Apache Dubbo versions prior to 3.0.5 dubbo hessian-lite versions 3.2.11 and earlier **Description** A deserialization vulnerability existed in dubbo hessian-lite, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol. During Hessian, catching unexpected exceptions will log out some information for users, which may cause remote command execution. **Recommendations** For Apache Dubbo versions prior to 2.6.12, update to version 2.6.12 or later. For Apache Dubbo versions prior to 2.7.15, update to version 2.7.15 or later. For Apache Dubbo versions prior to 3.0.5, update to version 3.0.5 or later. For dubbo hessian-lite versions 3.2.11 and earlier, update to a version later than 3.2.11. As a temporary workaround, consider disabling the Hessian2 protocol until a patch is available.