Non notée
CVE-2025-26866 A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization…
Description
A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache HugeGraph-Server 1.0 | 1.0.0 → < 1.7.0 | 1.7.0 |
Références
- github.com github.com
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache HugeGraph-Server
Les 4 CVE de Apache HugeGraph-Server →
CVE-2024-43441
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server
Non notée
CVE-2024-27349
Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server:…
Non notée
CVE-2024-27348
Apache HugeGraph-Server Improper Access Control Vulnerability
Non notée