CVE-2021-25640: Server-Side Request Forgery in Apache Dubbo
Summary
CVE-2021-25640: Server-Side Request Forgery in Apache Dubbo. Affects org.apache.dubbo:dubbo versions >= 2.5.0, < 2.7.10. Fixed in 2.7.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Dubbo is an open-source, high-performance, and lightweight Java RPC framework. It provides a distributed architecture for building scalable and efficient applications. The Dubbo package, specifically versions prior to 2.6.9 and 2.7.10, is vulnerable to a Server-Side Request Forgery (SSRF) attack. SSRF occurs when an attacker can manipulate the server-side requests made by the application, potentially leading to unauthorized access or information disclosure.
Vulnerability Detail
The vulnerability in Apache Dubbo arises from the usage of the parseURL method, which can bypass the white host check. This bypass can result in open redirect or SSRF vulnerabilities. An attacker can exploit this vulnerability to make arbitrary requests to internal resources or external systems, potentially leading to data leakage, remote code execution, or other malicious activities.
How To Fix
Latest published version: 3.3.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can implement input validation and sanitization techniques to mitigate the risk of SSRF attacks. By carefully validating and restricting user-supplied URLs, applications can prevent unauthorized requests to internal or external resources.
Conclusion
The Server-Side Request Forgery (SSRF) vulnerability in Apache Dubbo can lead to unauthorized access, data leakage, or remote code execution. It is crucial to upgrade to the fixed versions (2.6.9 or 2.7.10) and implement input validation to prevent potential SSRF attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.dubbo:dubbo →
FAQ
Apache Dubbo is a Java RPC framework that provides a distributed architecture for building scalable and efficient applications.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate server-side requests made by an application, potentially leading to unauthorized access or information disclosure.
Exploiting this vulnerability can result in data leakage, remote code execution, or other malicious activities. Attackers can make arbitrary requests to internal resources or external systems, bypassing security measures.
To fix this vulnerability, it is recommended to upgrade to Apache Dubbo version 2.6.9 or 2.7.10. Developers should also implement input validation and sanitization techniques to prevent SSRF attacks.
While there is no specific workaround provided, developers can mitigate the risk of SSRF attacks by implementing input validation and carefully reviewing user-supplied URLs.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dubbo:dubbo.
