PT-2026-43116 · Unknown · Tcc-Transaction

Ku4D3

·

CVE-2026-9497

·

Published

2026-05-25

·

Updated

2026-05-26

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions changmingxie tcc-transaction versions prior to 2.1.1
Description A remote deserialization issue exists within the Fastjson AutoType REST API component. The flaw is located in the Fastjson.parseObject() function, which allows an attacker to trigger deserialization remotely.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502CWE-20

Related Identifiers

CVE-2026-9497
GHSA-4R4V-3JC5-HRG9

Affected Products

Tcc-Transaction