{"cve":"CVE-2021-36163","nvd":{"published":"2021-09-07T10:15:07.333","modified":"2026-06-17T03:58:26.697","status":"Modified","description":"In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E","https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E"],"products":["apache:dubbo"],"source":"nvd","synced_at":"2026-10-19T21:21:57.125947417+00:00"},"epss":{"cve":"CVE-2021-36163","score":0.03253,"percentile":0.88344,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cpx9-4rwv-486v","url":"https://osv.dev/vulnerability/GHSA-cpx9-4rwv-486v","summary":"Hessian protocol configuration vulnerability in Apache Dubbo","modified":"2023-11-08T04:06:12.721387Z","packages":[{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo","purl":"pkg:maven/org.apache.dubbo/dubbo","ranges":[">=2.7.0 <2.7.13"],"fixed":["2.7.13"]},{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo","purl":"pkg:maven/org.apache.dubbo/dubbo","ranges":["<2.6.10.1"],"fixed":["2.6.10.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}