sofa-rpc vulnerabilities

2 known vulnerabilities in sofa-rpc from Sofastack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  sofa-rpc: Deserialization of Untrusted Data

  CVE-2024-23636Jan 23, 2024Sofastack

  SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.

• 9.8 Critical severity

  sofa-rpc: Improper Neutralization of Special Elements used in an Expression Language Statement

  CVE-2023-41331Sep 12, 2023SofastackEPSS 1.64%

  SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework