CVE-2023-29234

criticalpriority · track · 42EPSS 0.074 · 94 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

7.40% (94th) EPSS

CVSS 9.8 · critical

Is it mine?

8 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502US

affected products (8)

Products and version ranges known to be affected.

Apache Software Foundation Apache Dubbo≤ 3.1.0 ≤3.1.10enisa_euvdEU
Apache Software Foundation Apache Dubbo≤ 3.2.0 ≤3.2.4enisa_euvdEU
Apache Software Foundation Dubbo3.1.0 → 3.1.10fstec_bduRU
Apache Software Foundation Dubbo3.2.0 → 3.2.4fstec_bduRU
apache dubbo3.1.0 → 3.1.10nvdUScpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*
apache dubbo3.2.0 → 3.2.4nvdUScpe:2.3:a:apache:dubbo:*:*:*:*:*:*:*:*
Maven org.apache.dubbo:dubbo3.1.0 → 3.1.11osvUSpkg:maven/org.apache.dubbo/dubbo
Maven org.apache.dubbo:dubbo3.2.0 → 3.2.5osvUSpkg:maven/org.apache.dubbo/dubbo

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-6x49-w35h-wqrjBypass serialize checks in Apache Dubbo2023-12-15ghsa · osvUS
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2023-12-15modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan