Skip to content
Fencer Vulns
critical 9.8

CVE-2021-25641 in the critical feed json

Dubbo Zookeeper does not check serialization id

published 2021-05-29 5 y ago modified 2026-06-17 4 mo ago also GHSA-v2rg-8cwr-75g8 , EUVD-2022-1540

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.2%
EPSS 21.2% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

Patch / fix

  • maven org.apache.dubbo:dubbo 2.7.8
  • maven com.alibaba:dubbo 2.6.9
  • Apache Software Foundation Apache Dubbo 2.6.9, 2.7.8

Exploit prediction

21.22% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.dubbo:dubbo
>=2.5.0, <2.7.8
2.7.8
maven com.alibaba:dubbo
>=2.5.0, <2.6.9
2.6.9

Affected products

  • Apache Software Foundation Apache Dubbo

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.