CVE-2021-25641

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.

• CWE-502

• https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25631In the LibreOffice 7-1 series in versions prior to 7.1.2, an…8.8
• CVE-2021-25633LibreOffice supports digital signatures of ODF documents and…7.5
• CVE-2021-25634LibreOffice supports digital signatures of ODF documents and…7.5
• CVE-2021-25635An Improper Certificate Validation vulnerability in LibreOff…5.5
• CVE-2021-25636LibreOffice supports digital signatures of ODF documents and…7.5
• CVE-2021-25640In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parse…6.1
• CVE-2021-25642ZKConfigurationStore which is optionally used by CapacitySch…8.8
• CVE-2021-25643An issue was discovered in Couchbase Server 5.x and 6.x befo…4.9
• CVE-2021-25644An issue was discovered in Couchbase Server 5.x and 6.x thro…7.5
• CVE-2021-25645An issue was discovered in Couchbase Server before 6.0.5, 6.…4.4
• CVE-2021-25646Apache Druid includes the ability to execute user-provided J…8.8
• CVE-2021-25647Mobile application "Testes de Codigo" v11.3 and prior allows…5.4