WaratekVRT Sign in

CVE-2021-25641 Apache Dubbo

Affected softwareApache Dubbo
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in2.7.8
WeaknessDeserialization of untrusted data (CWE-502)
Published1 Jun 2021
Updated17 Jun 2026

Description

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC; first seen 2021-06-06.
  • EPSS 21% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Apache/Alibaba Dubbo <= 2.7.3 PoC Code for CVE-2021-25641 RCE via Deserialization of Untrusted Data; Affects Versions <= 2.7.6 With Different Gadgets 52 2021-06-06
GitHub PoC A Exploit Tool For CVE-2021-25641. 4 2022-11-10

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.dubbo:dubbo, com.alibaba:dubbo), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.dubbo:dubbo 2.5.0 2.7.8 unbounded
com.alibaba:dubbo 2.5.0 2.6.9 unbounded

Products and versions

3 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd apache dubbo generic ≥ 2.5.0 and ＜ 2.6.9 · ≥ 2.7.0 and ＜ 2.7.8
osv com.alibaba dubbo generic ≥ 2.5.0 and ＜ 2.6.9
osv org.apache.dubbo dubbo generic ≥ 2.5.0 and ＜ 2.7.8

References

URLTags
https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3E WEB

Timeline
Published2021-06-01By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.