Approved changes feed: RSS · Atom
cpe:2.3:a:apache:eventmesh:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Eventmesh (1be7ea2e-5993-5620-ab5d-21e1cfed17ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/eventmesh |
purl2cpe | 2026-06-01 10:14:24.551817 |
pkg:github/apache/eventmesh |
purl2cpe | 2026-06-01 10:14:24.551819 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-56180 |
vulnerable | 2026-06-08 06:54:17.486284 |
Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.
Published: 2025-02-14T13:34:26.600Z
Updated: 2025-02-18T15:10:16.650Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39954 |
vulnerable | 2026-06-08 06:41:52.132390 |
Apache EventMesh Runtime: SSRF
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
Published: 2025-08-20T08:56:41.560Z
Updated: 2025-08-20T13:20:27.851Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-26512 |
vulnerable | 2026-06-08 05:57:39.844586 |
Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data
CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and
remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.
Published: 2023-07-17T07:16:12.413Z
Updated: 2024-10-02T18:06:06.619Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.