An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade xmlrpc-javadocUpgrade xmlrpc-commonUpgrade xmlrpc-clientUpgrade xmlrpc-server | Jun 8, 2023 | Jan 23, 2020 |
| Debian | — | Upgrade libxmlrpc3-java | Feb 3, 2020 | Jan 23, 2020 |
| Gentoo Linux | — | Upgrade dev-java/xmlrpc. | Jan 23, 2024 | Jan 23, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 23, 2020 |
| Ubuntu | — | Upgrade libxmlrpc3-server-javaUpgrade libxmlrpc3-client-javaUpgrade libxmlrpc3-common-java | Sep 16, 2020 | Jan 23, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub