{"cve":"CVE-2021-43297","nvd":{"published":"2022-01-10T16:15:09.527","modified":"2026-06-17T04:10:48.567","status":"Modified","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww","https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww"],"products":["apache:dubbo"],"source":"nvd","synced_at":"2026-10-19T21:26:33.761856376+00:00"},"epss":{"cve":"CVE-2021-43297","score":0.16533,"percentile":0.97005,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-vp5x-3v8r-qprw","url":"https://osv.dev/vulnerability/GHSA-vp5x-3v8r-qprw","summary":"Deserialization of Untrusted Data in Dubbo","modified":"2023-11-08T04:07:09.482377Z","packages":[{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo","purl":"pkg:maven/org.apache.dubbo/dubbo","ranges":[">=2.6.0 <2.6.12"],"fixed":["2.6.12"]},{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo","purl":"pkg:maven/org.apache.dubbo/dubbo","ranges":[">=2.7.0 <2.7.15"],"fixed":["2.7.15"]},{"ecosystem":"Maven","name":"org.apache.dubbo:dubbo","purl":"pkg:maven/org.apache.dubbo/dubbo","ranges":[">=3.0.0 <3.0.5"],"fixed":["3.0.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}