CVE-2021-25641: Deserializer Tampering in Apache Dubbo
Summary
CVE-2021-25641: Deserializer tampering in Apache Dubbo. Affects org.apache.dubbo:dubbo versions >= 2.5.0, < 2.7.8. Fixed in 2.7.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Dubbo is an open-source, high-performance, and lightweight Java RPC (Remote Procedure Call) framework. It provides support for multiple serialization protocols to enable communication between distributed systems. However, versions before 2.7.8 or 2.6.9 of Apache Dubbo are vulnerable to deserializer tampering.
Vulnerability Detail
The vulnerability in Apache Dubbo allows an attacker to manipulate the serialization id used by the server, bypassing the server's instruction. This means that if a weak deserializer, such as Kryo or FST, is present in the code scope, an unauthenticated remote attacker can force the server to use the weak deserializer and potentially exploit it. This can lead to remote code execution or other malicious activities.
How To Fix
Latest published version: 3.3.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround is to remove any weak deserializers, such as Kryo or FST, from the code scope. This can be achieved by excluding the vulnerable deserializer dependency or replacing it with a secure alternative. Here's an example of excluding the Kryo dependency in Maven:
<dependency>
<groupId>org.apache.dubbo</groupId>
<artifactId>dubbo</artifactId>
<version>2.7.7</version>
<exclusions>
<exclusion>
<groupId>com.esotericsoftware.kryo</groupId>
<artifactId>kryo</artifactId>
</exclusion>
</exclusions>
</dependency>
Conclusion
The deserializer tampering vulnerability in Apache Dubbo can be mitigated by upgrading to the fixed versions or removing vulnerable deserializers from the code scope. It is crucial to promptly address this vulnerability to prevent potential exploitation and protect the security of your application.
See every vulnerability recorded for org.apache.dubbo:dubbo →
FAQ
Apache Dubbo is a Java RPC framework that enables communication between distributed systems. It provides high performance and lightweight remote procedure calls.
Deserializer tampering refers to the manipulation of the serialization id used by a server. In the case of Apache Dubbo, an attacker can force the server to use a weak deserializer by tampering with the serialization flags.
The vulnerability in Apache Dubbo can allow an attacker to exploit weak deserializers, leading to remote code execution or other malicious activities. This can result in unauthorized access, data breaches, or system compromise.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dubbo:dubbo.
