CVE-2026-66713
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-502
Deserialización de datos no confiables
Fecha de publicación:
28/07/2026
Última modificación:
28/07/2026
Descripción
*** Pendiente de traducción *** Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component<br />
<br />
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat<br />
<br />
(only when Tribes clustering is enabled, which is off by default) allows an<br />
<br />
unauthenticated remote attacker with network access to the clustering port to<br />
<br />
execute arbitrary code via a crafted serialized Java object delivered to the cluster<br />
<br />
channel and deserialized in<br />
<br />
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are<br />
<br />
recommended to upgrade to version 2.0.1, which fixes this issue by removing the<br />
<br />
clustering feature entirely.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA