{"action":"Upgrade org.apache.dubbo:dubbo to 2.6.10.1 (2.6.x) or 2.7.13 (2.7.x) or later.","affected":[{"fixed":"2.7.13","introduced":"2.7.0"},{"fixed":"2.6.10.1","introduced":"0"}],"component":"org.apache.dubbo:dubbo","cve_ids":["CVE-2021-36163"],"ecosystem":"Maven","epss":0.03253,"exploited":false,"fixed_versions":["2.7.13","2.6.10.1"],"ghsa_id":"GHSA-cpx9-4rwv-486v","id":"tcs_01M5N8SZ4XEPTM8ZGMP7EJSE9S","modified_at":"2023-11-08T04:06:12.721387Z","published_at":"2021-09-08T20:14:14Z","references":["https://osv.dev/vulnerability/GHSA-cpx9-4rwv-486v","https://nvd.nist.gov/vuln/detail/CVE-2021-36163","https://github.com/apache/dubbo/pull/8238","https://github.com/apache/dubbo","https://github.com/apache/dubbo/releases/tag/dubbo-2.6.10.1","https://github.com/apache/dubbo/releases/tag/dubbo-2.7.13","https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-cpx9-4rwv-486v","url":"https://osv.dev/vulnerability/GHSA-cpx9-4rwv-486v"}],"summary":"Hessian protocol configuration vulnerability in Apache Dubbo"}