{"id":"CVE-2019-17564","details":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","aliases":["GHSA-69wp-3pm3-hxgg"],"modified":"2026-07-08T19:02:35.712793Z","published":"2020-04-01T22:15:15.847Z","references":[{"type":"ADVISORY","url":"https://advisory.checkmarx.net/advisory/CX-2020-4275"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r13f7a58fa5d61d729e538a378687118e00c3e229903ba1e7b3a807a2%40%3Cdev.dubbo.apache.org%3E"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/dubbo","events":[{"introduced":"31ca18c712de2016795ba59f499f7c254f9281d5"},{"last_affected":"04576ff4ffdd5872e738b4e10e3905fe513109d2"},{"introduced":"22bb9cbcf75cab6445b8706574a986517855b535"},{"last_affected":"eac84b290f82bb5346a449a973315b6860a9e665"},{"introduced":"614bcebc01336ee5047a98f96b28915680c0399c"},{"last_affected":"1d7e8fac4523d7482d5f2d8f25dd024807e3d3d5"}],"database_specific":{"cpe":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.5.0"},{"last_affected":"2.5.10"},{"introduced":"2.6.0"},{"last_affected":"2.6.7"},{"introduced":"2.7.0"},{"last_affected":"2.7.4"}],"source":"CPE_RANGE"}}],"versions":["dubbo-2.7.4","dubbo-2.6.7","dubbo-2.6.6","dubbo-2.6.1","dubbo-2.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17564.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}