CVE-2021-33790

9.8 criticalEPSS 2.8%

Critical (9.8) in techreborn reborncore. EPSS 2.8% chance of exploitation in the next 30 days.

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2021-05-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

techreborn:reborncore

References

https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrm
https://vuln.ryotak.me/advisories/45
https://www.curseforge.com/minecraft/mc-mods/reborncore
https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrm
https://vuln.ryotak.me/advisories/45

Check your stack JSON