Approved changes feed: RSS · Atom
cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Dubbo (f939eb2a-7e0b-57c9-b330-e98ac680059e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/dubbo |
purl2cpe | 2026-06-01 10:14:32.022337 |
pkg:github/apache/dubbo |
purl2cpe | 2026-06-01 10:14:32.022339 |
pkg:maven/org.apache.dubbo/dubbo |
purl2cpe | 2026-06-01 10:14:32.022340 |
pkg:sourceforge/apache-dubbo.mirror |
purl2cpe | 2026-06-01 10:14:32.022342 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-29234 |
vulnerable | 2026-06-08 06:02:39.163352 |
Bypass serialize checks in Apache Dubbo
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.
Users are recommended to upgrade to the latest version, which fixes the issue.
Published: 2023-12-15T08:14:47.561Z
Updated: 2025-02-13T16:49:03.349Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23638 |
vulnerable | 2026-06-08 05:56:04.137669 |
Apache Dubbo Deserialization Vulnerability Gadgets Bypass
MEDIUM (5)
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution.
This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Published: 2023-03-08T10:48:58.574Z
Updated: 2024-10-23T16:41:29.622Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39198 |
vulnerable | 2026-06-08 05:47:18.328440 |
Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
Published: 2022-10-18T00:00:00.000Z
Updated: 2025-05-13T14:48:42.604Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24969 |
vulnerable | 2026-06-08 05:41:45.016172 |
bypass of CVE-2021-25640
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
Published: 2022-06-06T22:00:16.000Z
Updated: 2024-08-03T04:29:01.633Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43297 |
vulnerable | 2026-06-08 05:36:43.113939 |
Dubbo Hessian cause RCE when parse error
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Published: 2022-01-10T15:25:48.000Z
Updated: 2024-08-04T03:55:28.375Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37579 |
vulnerable | 2026-06-08 05:32:54.437105 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36163 |
vulnerable | 2026-06-08 05:32:49.819528 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36162 |
vulnerable | 2026-06-08 05:32:49.819074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36161 |
vulnerable | 2026-06-08 05:32:49.818549 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32824 |
vulnerable | 2026-06-08 05:32:08.116837 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30181 |
vulnerable | 2026-06-08 05:31:47.114297 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30180 |
vulnerable | 2026-06-08 05:31:47.113844 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-30179 |
vulnerable | 2026-06-08 05:31:47.113330 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25641 |
vulnerable | 2026-06-08 05:30:41.140898 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25640 |
vulnerable | 2026-06-08 05:30:41.140462 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-1948 |
vulnerable | 2026-06-08 05:21:03.722304 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11995 |
vulnerable | 2026-06-08 05:17:56.070810 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-17564 |
vulnerable | 2026-06-08 05:13:10.686212 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.