CVE-2026-19826: alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization
A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19826?
CVE-2026-19826 has a high severity rating of 7.3.
What component is affected by CVE-2026-19826?
CVE-2026-19826 affects the xxl-rpc Listener in alldatacenter alldata up to version 0.6.8.
What type of vulnerability is CVE-2026-19826?
CVE-2026-19826 is a deserialization vulnerability caused by improper input validation.
How can CVE-2026-19826 be exploited?
CVE-2026-19826 can be exploited remotely through the Hessian2Input.readObject function.
How do I fix CVE-2026-19826?
To fix CVE-2026-19826, upgrade to a patched version of alldatacenter alldata beyond 0.6.8 that addresses this vulnerability.