CVE-2026-123374

Not scored yetLast modified Nov 12, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Apache Software FoundationApache Roller>= 4.0, <= 6.1.6

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1233758.8Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233768.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233778.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233787.5Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233797.5Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233808.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233818.8Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233828.8Untrusted pointer dereference in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233838.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233848.8Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1233858.8Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1233878.0Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacke
CVE-2026-123374: Unscored | Vulnix