CVE-2026-19826
Received Received - Intake

Deserialization Vulnerability in alldata up to 0.6.8

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19826
EUVD
EUVD-2026-58657

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
alldatacenter alldata to 0.6.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a deserialization flaw in alldatacenter alldata up to version 0.6.8. It affects the Hessian2Input.readObject function in the xxl-rpc Listener component. The issue allows remote attackers to execute arbitrary code by sending a crafted serialized object to the exposed Netty listener on TCP port 7080. The project owner closed the issue without plans to fix it.

Detection Guidance
  • Scan for open TCP port 7080 on your network or system using tools like nmap: nmap -p 7080 <target_IP>
  • Check for active xxl-rpc Netty listeners using netstat or ss: netstat -tulnp | grep 7080 or ss -tulnp | grep 7080
  • Inspect network traffic for unusual Hessian2 deserialization requests using Wireshark or tcpdump
Impact Analysis

An attacker could exploit this to run malicious code on your system remotely without authentication. This could lead to data theft, system compromise, or further network infiltration. The vulnerability is public, increasing the risk of exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies
  • Close or restrict access to TCP port 7080 to prevent unauthenticated remote access
  • Configure a non-empty access token for the xxl-rpc listener to enforce authentication
  • Upgrade the xxl-rpc library to a version with hardened Hessian2 deserializer and type filtering
  • Implement strict allowlisting for deserialized types in Hessian2Input.readObject()

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart