CVE-2024-26579

CRITICAL

Apache InLong 1.7.0-1.11.0 - Deserialization of Untrusted Data via Malicious Parameters

Title source: llm
STIX 2.1

Description

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0,  the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https://github.com/apache/inlong/pull/9694 [2]  https://github.com/apache/inlong/pull/9707

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0041
EPSS Percentile 61.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-502
Status published
Products (2)
apache/inlong 1.7.0 - 1.12.0
org.apache.inlong/manager-pojo 1.7.0 - 1.12.0Maven
Published May 08, 2024
Tracked Since Feb 18, 2026