CVE-2026-82384

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no non-default configuration is required for this path. This can lead to remote code execution. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which disables the extension types and rejects requests when the XML-RPC feature is disabled.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/roller/pull/171
https://lists.apache.org/thread/21p1dh6x179gmcdpw84kkx9yclrdp410
http://www.openwall.com/lists/oss-security/2026/09/25/17

Configurations

No configuration.

History

28 Sep 2026, 09:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/09/25/17 -

28 Sep 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 08:16

Updated : 2026-09-29 04:18

NVD link : CVE-2026-82384

Mitre link : CVE-2026-82384

CVE.ORG link : CVE-2026-82384

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-82384", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82384", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-28T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Roller", "versions": [{"status": "affected", "version": "6.1.5", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-09-28T08:16:42.273", "references": [{"url": "https://github.com/apache/roller/pull/171", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/21p1dh6x179gmcdpw84kkx9yclrdp410", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/25/17", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no non-default configuration is required for this path. This can lead to remote code execution. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which disables the extension types and rejects requests when the XML-RPC feature is disabled."}], "lastModified": "2026-09-29T04:18:00.500", "sourceIdentifier": "security@apache.org"}