CVE-2021-30179

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.

• CWE-502

• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rccbcbdd6593e42ea3a1e8fedd12807cb111375c9c40edb005ef36f67%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30173Local File Inclusion vulnerability of the omni-directional c…6.5
• CVE-2021-30174RiyaLab CloudISO event item is added, special characters in …5.4
• CVE-2021-30175ZEROF Web Server 1.0 (April 2021) allows SQL Injection via t…9.8
• CVE-2021-30176The ZEROF Expert pro/2.0 application for mobile devices allo…9.8
• CVE-2021-30177There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in …9.8
• CVE-2021-30178An issue was discovered in the Linux kernel through 5.11.11.…5.5
• CVE-2021-3018ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerabl…9.8
• CVE-2021-30180Apache Dubbo prior to 2.7.9 support Tag routing which will e…9.8
• CVE-2021-30181Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routin…9.8
• CVE-2021-30183Cleartext storage of sensitive information in multiple versi…7.5
• CVE-2021-30184GNU Chess 6.2.7 allows attackers to execute arbitrary code v…7.8
• CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host h…7.5