{"api_version":"1","generated_at":"2026-07-23T19:19:11+00:00","cve":"CVE-2021-43297","urls":{"html":"https://cve.report/CVE-2021-43297","api":"https://cve.report/api/cve/CVE-2021-43297.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-43297","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-43297"},"summary":{"title":"CVE-2021-43297","description":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2022-01-10 16:15:00","updated_at":"2022-01-18 20:10:00"},"problem_types":["CWE-502"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww","name":"https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww","refsource":"MISC","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43297","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43297","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"There are differences in the use of entrances. The following people or organizations reported security vulnerabilities independently. Sort by discovery time: 1. cxc&yhbl&wh1t3p1g&fynch3r from G5-RD6@IIE 2. yxxx","lang":""}],"nvd_cpes":[{"cve_year":"2021","cve_id":"43297","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"dubbo","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2021-43297","STATE":"PUBLIC","TITLE":"Dubbo Hessian cause RCE when parse error"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache Dubbo","version":{"version_data":[{"version_affected":"<","version_name":"Apache Dubbo 2.6.x","version_value":"2.6.12"},{"version_affected":"<","version_name":"Apache Dubbo 2.7.x","version_value":"2.7.15"},{"version_affected":"<","version_name":"Apache Dubbo 3.0.x","version_value":"3.0.5"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"credit":[{"lang":"eng","value":"There are differences in the use of entrances. The following people or organizations reported security vulnerabilities independently. Sort by discovery time: 1. cxc&yhbl&wh1t3p1g&fynch3r from G5-RD6@IIE 2. yxxx"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":[{"other":"high"}],"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-502 Deserialization of Untrusted Data"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww","name":"https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-01-10 16:15:00","lastModifiedDate":"2022-01-18 20:10:00","problem_types":["CWE-502"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.7.0","versionEndExcluding":"2.7.15","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndExcluding":"2.6.12","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"43297","Ordinal":"220349","Title":"CVE-2021-43297","CVE":"CVE-2021-43297","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"43297","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}