CVE-2026-66256

Katalog CVE

CVSS 7.2 · High EPSS 0,94%

Kerentanan Deserialization of Untrusted Data pada apache shindig. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 59,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkh mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/13/7 mailing list · advisory pihak ketiga