{"url":"http://public2.vulnerablecode.io/api/packages/137669?format=json","purl":"pkg:maven/org.apache.dubbo/dubbo@2.7.22","type":"maven","namespace":"org.apache.dubbo","name":"dubbo","version":"2.7.22","qualifiers":{},"subpath":"","is_vulnerable":false,"next_non_vulnerable_version":"3.0.13","latest_non_vulnerable_version":"3.2.5","affected_by_vulnerabilities":[],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44630?format=json","vulnerability_id":"VCID-f4ha-rjpx-yfgb","summary":"Deserialization of Untrusted Data\nA deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23638","reference_id":"","reference_type":"","scores":[{"value":"0.50291","scoring_system":"epss","scoring_elements":"0.97891","published_at":"2026-06-05T12:55:00Z"},{"value":"0.50291","scoring_system":"epss","scoring_elements":"0.97893","published_at":"2026-06-08T12:55:00Z"},{"value":"0.50291","scoring_system":"epss","scoring_elements":"0.97892","published_at":"2026-06-06T12:55:00Z"},{"value":"0.50291","scoring_system":"epss","scoring_elements":"0.97887","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-23638"},{"reference_url":"https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb","reference_id":"","reference_type":"","scores":[{"value":"5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-23T16:41:19Z/"}],"url":"https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23638","reference_id":"CVE-2023-23638","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23638"},{"reference_url":"https://github.com/advisories/GHSA-933g-v89r-x8pf","reference_id":"GHSA-933g-v89r-x8pf","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-933g-v89r-x8pf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/64254?format=json","purl":"pkg:maven/org.apache.dubbo/dubbo@2.7.21","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dubbo/dubbo@2.7.21"},{"url":"http://public2.vulnerablecode.io/api/packages/137669?format=json","purl":"pkg:maven/org.apache.dubbo/dubbo@2.7.22","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dubbo/dubbo@2.7.22"},{"url":"http://public2.vulnerablecode.io/api/packages/64255?format=json","purl":"pkg:maven/org.apache.dubbo/dubbo@3.0.13","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dubbo/dubbo@3.0.13"},{"url":"http://public2.vulnerablecode.io/api/packages/64256?format=json","purl":"pkg:maven/org.apache.dubbo/dubbo@3.1.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3byz-42xs-3khg"},{"vulnerability":"VCID-4cur-ezpv-k7fx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dubbo/dubbo@3.1.5"}],"aliases":["CVE-2023-23638","GHSA-933g-v89r-x8pf"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-f4ha-rjpx-yfgb"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.dubbo/dubbo@2.7.22"}