CVE-2020-11995

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HasMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.

• CWE-502
• CWE-502

• https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r5b2df4ef479209dc4ced457b3d58a887763b60b9354c3dc148b2eb5b%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Published

Jan 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1199An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11990We have resolved a security issue in the camera plugin that …3.3
• CVE-2020-11991When using the StreamGenerator, the code parse a user-provid…7.5
• CVE-2020-11992Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debu…7.5
• CVE-2020-11994Server-Side Template Injection and arbitrary file disclosure…7.5
• CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apac…7.5
• CVE-2020-11997Apache Guacamole 1.2.0 and earlier do not consistently restr…4.3
• CVE-2020-11998A regression has been introduced in the commit preventing JM…9.8
• CVE-2020-11999FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…8.1
• CVE-2020-1200<p>A remote code execution vulnerability exists in Microsoft…8.6
• CVE-2020-12000The affected product is vulnerable to the handling of serial…7.5