CVE-2021-37578

CVE-2021-37578 describes a critical deserialization vulnerability in Apache jUDDI, specifically within its optional Remote Method Invocation (RMI) functionality. A remote attacker could exploit this by sending a malicious serialized object to jUDDI's RMI entries, potentially leading to arbitrary code execution due to unchecked deserialization. While the CVSS score is 9.8 (Critical) with a network attack vector and low attack complexity, the impact likelihood is considered low as RMI is disabled by default and is an optional extension. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, and it is not listed in CISA's KEV catalog.