CVE-2021-30180

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

• CWE-444

• https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/raed526465e56204030ddf374b1959478a290e7511971d7aba2e9e39b%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30175ZEROF Web Server 1.0 (April 2021) allows SQL Injection via t…9.8
• CVE-2021-30176The ZEROF Expert pro/2.0 application for mobile devices allo…9.8
• CVE-2021-30177There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in …9.8
• CVE-2021-30178An issue was discovered in the Linux kernel through 5.11.11.…5.5
• CVE-2021-30179Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports ge…9.8
• CVE-2021-3018ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerabl…9.8
• CVE-2021-30181Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routin…9.8
• CVE-2021-30183Cleartext storage of sensitive information in multiple versi…7.5
• CVE-2021-30184GNU Chess 6.2.7 allows attackers to execute arbitrary code v…7.8
• CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host h…7.5
• CVE-2021-30186CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-base…7.5
• CVE-2021-30187CODESYS V2 runtime system SP before 2.4.7.55 has Improper Ne…5.3