CVE-2022-39198

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Dubbo	>= Apache Dubbo 2.7.x, <= 2.7.17; >= Apache Dubbo 3.0.x, <= 3.0.11; >= Apache Dubbo 3.1.x, <= 3.1.0

References

https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkkMailing List, Vendor Advisory
https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkkMailing List, Vendor Advisory

Timeline

Published: Oct 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-391995.9immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between differe CVE-2022-39207.5HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC end CVE-2022-392005.3Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events CVE-2022-392017.5Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and CVE-2022-392026.3matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple CVE-2022-392038.8matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would co CVE-2022-392059.8Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take CVE-2022-392069.9Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/CVE-2022-392075.4Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for late CVE-2022-392087.5Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be CVE-2022-392096.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polyno CVE-2022-39219.8The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, whic