Description
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, 

the attackers can bypass using malicious parameters.

Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it.

[1] https://github.com/apache/inlong/pull/9694

[2]  https://github.com/apache/inlong/pull/9707
Published: 2024-05-08
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-1601 Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0,  the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https://github.com/apache/inlong/pull/9694 [2]  https://github.com/apache/inlong/pull/9707
Github GHSA Github GHSA GHSA-fgh3-pwmp-3qw3 Apache Inlong Deserialization of Untrusted Data vulnerability
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00181}

 epss

{'score': 0.00237}

Thu, 13 Feb 2025 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache Software Foundation
Apache Software Foundation apache Inlong
CPEs cpe:2.3:a:apache_software_foundation:apache_inlong:*:*:*:*:*:*:*:*
Vendors & Products Apache Software Foundation
Apache Software Foundation apache Inlong
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Feb 2025 17:45:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0,  the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https://github.com/apache/inlong/pull/9694 [2]  https://github.com/apache/inlong/pull/9707 Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0,  the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https://github.com/apache/inlong/pull/9694 [2]  https://github.com/apache/inlong/pull/9707

Tue, 11 Feb 2025 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache inlong
CPEs cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache inlong
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Apache Inlong
Apache Software Foundation Apache Inlong
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2025-03-28T18:52:24.649Z

Reserved: 2024-02-19T09:14:11.118Z

Link: CVE-2024-26579

cve-icon Vulnrichment

Updated: 2024-08-02T00:07:19.519Z

cve-icon NVD

Status : Modified

Published: 2024-05-08T15:15:08.817

Modified: 2025-03-28T19:15:20.193

Link: CVE-2024-26579

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses