Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-19826: alldatacenter alldata xxl-rpc Listener Deserialization Risk
CVE-2026-19826 · published 2 months ago
Summary
A security risk exists in alldatacenter alldata versions up to 0.6.8. This affects the xxl-rpc Listener component, which can allow attackers to execute malicious code remotely. We recommend updating to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| alldatacenter | alldata | 0.6.0 |
Original advisory text
alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization
A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-502Deserialization of Untrusted Data
CWE-20Improper Input Validation
Timeline
Published14 Aug 2026
Updated4 Nov 2026
First seen14 Aug 2026
Track software like this
Free during beta