CVE-2026-19826CWE-20CWE-502insecure-deserialization

CVE-2026-19826

High · published August 14, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00564 · 46.1th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2026-08-14T17:17Z
References (7)
https://github.com/alldatacenter/alldata/ · [email protected]https://github.com/alldatacenter/alldata/issues/832 · [email protected]https://vuldb.com/cve/CVE-2026-19826 · [email protected]https://vuldb.com/submit/870236 · [email protected]https://vuldb.com/vuln/389959 · [email protected]https://vuldb.com/vuln/389959/cti · [email protected]https://github.com/alldatacenter/alldata/issues/832 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 AUG 13:00Z
    alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization
    cvelistv5