CVE-2021-30180: Code Injection in Apache Dubbo
Summary
CVE-2021-30180: Code injection in Apache Dubbo. Affects org.apache.dubbo:dubbo versions >= 2.7.0, < 2.7.10. Fixed in 2.7.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Dubbo is an open-source, high-performance, and lightweight Java RPC framework. It provides support for distributed service development and management. Dubbo allows customers to define rules for routing requests to the appropriate server. These rules are used to find the correct endpoint when making a request. However, prior to version 2.7.9, Dubbo's YAML rule parsing functionality had a vulnerability that could enable calling arbitrary constructors.
Vulnerability Detail
The vulnerability (CVE-2021-30180) in Apache Dubbo allows an attacker to perform code injection by exploiting the Tag routing feature. By manipulating the YAML rules used for routing requests, an attacker can execute arbitrary code by calling constructors. This can lead to remote code execution, privilege escalation, and unauthorized access to sensitive information. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 3.3.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Apache Dubbo to mitigate the risk of code injection.
Conclusion
The code injection vulnerability (CVE-2021-30180) in Apache Dubbo can have severe consequences, including remote code execution and unauthorized access. It is crucial to update to the fixed version of Apache Dubbo (2.7.10 or later) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.dubbo:dubbo →
FAQ
Apache Dubbo is a Java RPC framework that provides support for distributed service development and management.
Tag routing is a feature in Apache Dubbo that allows customers to define rules for routing requests to the appropriate server based on tags.
Code injection is a security vulnerability that allows an attacker to insert and execute malicious code in a target application.
This vulnerability can lead to remote code execution, privilege escalation, and unauthorized access to sensitive information.
To fix this vulnerability, update your Apache Dubbo dependency to version 2.7.10 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dubbo:dubbo.
