CVE-2021-43297

CRITICAL

Apache Dubbo <2.6.12, <2.7.15, <3.0 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-43297.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2021-43297, a deserialization vulnerability in Apache Dubbo's Hessian2 protocol. The exploit includes client and server components to demonstrate the vulnerability, with modified Hessian2 serialization logic to trigger the flaw.

Description

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

Exploits (2)

inthewild WORKING POC
poc
https://github.com/longofo/apache-dubbo-hessian2-cve-2021-43297

This repository contains a functional exploit PoC for CVE-2021-43297, a deserialization vulnerability in Apache Dubbo's Hessian2 protocol. The exploit includes client and server components to demonstrate the vulnerability, with modified Hessian2 serialization logic to trigger the flaw.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Apache Dubbo (Hessian2 protocol)
No auth needed
Prerequisites: Apache Dubbo server with vulnerable Hessian2 implementation · Network access to the target server
devstral-2 · analyzed Feb 23, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/bitterzzzz/cve-2021-43297-poc

This repository contains a functional exploit PoC for CVE-2021-43297, targeting a deserialization vulnerability in Apache Dubbo's HessianLite implementation. The exploit crafts a malicious payload to achieve remote code execution (RCE) via a custom HTTP server serving a malicious class file.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apache Dubbo (HessianLite)
No auth needed
Prerequisites: Network access to vulnerable Dubbo service · Dubbo service exposed on default or known port (e.g., 20880)
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (1)

Core 1
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://lists.apache.org/thread/1mszxrvp90y01xob56yp002939c7hlww

Scores

CVSS v3 9.8
EPSS 0.4630
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
apache/dubbo 2.6.0 - 2.6.12
org.apache.dubbo/dubbo 2.6.0 - 2.6.12Maven
Published Jan 10, 2022
Tracked Since Feb 18, 2026