CVE-2021-33790

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrmThird Party Advisory
https://vuln.ryotak.me/advisories/45Third Party Advisory
https://www.curseforge.com/minecraft/mc-mods/reborncoreProduct, Third Party Advisory
https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrmThird Party Advisory
https://vuln.ryotak.me/advisories/45Third Party Advisory
https://www.curseforge.com/minecraft/mc-mods/reborncoreProduct, Third Party Advisory

Timeline

Published: May 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-337927.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.CVE-2021-337939.8Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write because the Cross-Reference table is mishandled during O CVE-2021-337949.1Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 allow information disclosure or an application crash after mishandling the Tab key d CVE-2021-337955.5Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document own CVE-2021-337967.5In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.CVE-2021-337979.8Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point CVE-2021-337986.5A null pointer dereference was found in libpano13, version libpano13-2.9.20. The flow allows attackers to cause a denial of service and pote CVE-2021-33806.5Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Inv CVE-2021-338007.5In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.CVE-2021-338069.8The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStrea CVE-2021-338077.5Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.CVE-2021-338137.5An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.