JFinal Java Deserialization Vulnerability

published 2021-06-24 5 y ago modified 2026-06-17 4 mo ago also GHSA-h3j8-fr5q-8rfr , EUVD-2022-4052

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code execute

Exploit prediction

1.82% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

note.youdao.com http://note.youdao.com/noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4 referenced PoC, tagged "exploit" by a source, unverified
note.youdao.com https://note.youdao.com/ynoteshare1/index.html?id=787ccbb8345dbd4a905aebe35f1d8aa8&type=note referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	com.jfinal:jfinal	<=4.9.08	no fix listed

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

note.youdao.com /noteshare?id=787ccbb8345dbd4a905aebe35f1d8aa8&sub=6C5C072C901949429EFD978405212FA4
web, exploit, third-party-advisory
note.youdao.com /ynoteshare1/index.html?id=787ccbb8345dbd4a905aebe35f1d8aa8&type=note
exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-31649
advisory
github.com /jfinal/jfinal/issues/184
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary