CVE-2026-19826

alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

State: Published
Severity: 6.9 Medium
Published: Aug 14, 2026
Updated: Aug 18, 2026
Reserved: Aug 14, 2026

Description

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
alldataalldatacenter	0.6.0Affected 0.6.1Affected 0.6.2Affected 0.6.3Affected 0.6.4Affected 0.6.5Affected 0.6.6Affected 0.6.7Affected 0.6.8Affected

References

VDB-389959 | alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserializationvdb-entrytechnical-description
VDB-389959 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-19826 | CVE Analysis and Reportthird-party-advisory
Submit #870236 | alldatacenter alldata v0.6.8 CWE-502third-party-advisory
https://github.com/alldatacenter/alldata/issues/832exploitissue-tracking
https://github.com/alldatacenter/alldata/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.