CVE-2019-17564
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to...
- Published
- Apr 1, 2020
- Updated
- Aug 5, 2024
- Assigning CNA
- apache
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.5%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Sources
dubbo/CVE-2019-17564
Aapche Dubbo Unsafe Java Deserialization (CVE-2019-17564)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/dubbo:2.7.3(dubbo/CVE-2019-17564/docker-compose.yml:services.provider.image)
- lab image version: zookeeper:3.7.0(dubbo/CVE-2019-17564/docker-compose.yml:services.zookeeper.image)
http/cves/2019/CVE-2019-17564.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.