Dashboard / CVE-2026-123374

CVE-2026-123374

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-11-11 Modified: 2026-11-12 First seen: 2026-11-11 Status: pending_score

Description

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Apache Software Foundation Apache Roller 4.0

References & Advisories (2)

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.40%
Raw Score 0.004030
Percentile 35.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00403
2026-11-12
0.00403

Intelligence Sources

mitre ref →
nvd ref →

External Links