Not rated
CVE-2025-26866 A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization…
Description
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HugeGraph-Server 1.0 | 1.0.0 → < 1.7.0 | 1.7.0 |
References
- github.com github.com
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache HugeGraph-Server
The 4 CVEs of Apache HugeGraph-Server →
CVE-2024-43441
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server
Not rated
CVE-2024-27349
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server:…
Not rated
CVE-2024-27348
Apache HugeGraph-Server Improper Access Control Vulnerability
Not rated