CVE-2023-29234: Bypass serialize checks in Apache Dubbo

December 15, 2023 (updated February 13, 2025)

A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.

Users are recommended to upgrade to the latest version, which fixes the issue.

References

github.com/advisories/GHSA-6x49-w35h-wqrj
github.com/apache/dubbo
lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77
nvd.nist.gov/vuln/detail/CVE-2023-29234

Code Behaviors & Features

Detect and mitigate CVE-2023-29234 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →