{"api_version":"1","generated_at":"2026-11-11T13:51:01+00:00","cve":"CVE-2026-123374","urls":{"html":"https://cve.report/CVE-2026-123374","api":"https://cve.report/api/cve/CVE-2026-123374.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-123374","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-123374"},"summary":{"title":"Apache Roller: Deserialization of untrusted data in weblog update ping responses","description":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-11 13:17:17","updated_at":"2026-11-11 13:17:17"},"problem_types":["CWE-502","CWE-502 CWE-502: Deserialization of Untrusted Data"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt","name":"https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/apache/roller/pull/236","name":"https://github.com/apache/roller/pull/236","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-123374","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123374","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Roller","version":"affected 4.0 6.1.6 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"David Joudelat","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://github.com/apache/roller","defaultStatus":"unknown","product":"Apache Roller","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"6.1.6","status":"affected","version":"4.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"David Joudelat"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.</p>"}],"value":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization."}],"metrics":[{"other":{"content":{"text":"Important"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-11T12:41:36.635Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["patch"],"url":"https://github.com/apache/roller/pull/236"},{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt"}],"source":{"discovery":"EXTERNAL"},"title":"Apache Roller: Deserialization of untrusted data in weblog update ping responses","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-123374","datePublished":"2026-11-11T12:41:36.635Z","dateReserved":"2026-11-05T21:50:30.293Z","dateUpdated":"2026-11-11T12:41:36.635Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-11 13:17:17","lastModifiedDate":"2026-11-11 13:17:17","problem_types":["CWE-502","CWE-502 CWE-502: Deserialization of Untrusted Data"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"123374","Ordinal":"1","Title":"Apache Roller: Deserialization of untrusted data in weblog updat","CVE":"CVE-2026-123374","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"123374","Ordinal":"1","NoteData":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.","Type":"Description","Title":"Apache Roller: Deserialization of untrusted data in weblog updat"}]}}}