CVE-2026-41586

Katalog CVE

CVSS 9.8 · Critical EPSS 0,63%

Kerentanan Deserialization of Untrusted Data pada hyperledger fabric. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

25 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 exploit · mitigasi · advisory vendor
• https://hyperledger.github.io/fabric-gateway product