CVE-2026-123374: Apache Roller: Deserialization of untrusted data in weblog update ping responses

Published Nov 11, 2026

Updated

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Roller to a version that resolves this vulnerability.
Fixed in 6.1.7

Event History

Nov 11, 2026

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

DescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to control the response from a weblog update ping target that the Roller server contacts. The attacker can then supply Java object data in the XML-RPC response for deserialization by Roller.

Are default installations affected?

The issue is triggered when Roller sends a weblog update ping to a target. The available information does not state whether such ping targets are configured or used by default.

Which versions need to be remediated?

Apache Roller versions 4.0 through 6.1.6 are affected. Upgrade to 6.1.7, which removes the unsafe deserialization.

What can be done before upgrading?

Prevent Roller from sending weblog update pings to targets whose responses are not trusted. This removes the attacker-controlled response path described for exploitation.

CVE-2026-123374: Apache Roller: Deserialization of untrusted data in weblog update ping responses

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

Which versions need to be remediated?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default installations affected?

Which versions need to be remediated?

What can be done before upgrading?