CVE-2021-43297

CVE-2021-43297 is a critical deserialization vulnerability in Apache Dubbo, affecting versions 2.6.x prior to 2.6.12, 2.7.x prior to 2.7.15, and 3.0.x prior to 3.0.5. This flaw, stemming from the hessian-lite library, allows for remote code execution due to improper handling of unexpected exceptions during Hessian serialization/deserialization. With a CVSS score of 9.8 (Critical), it presents a severe risk as it can be exploited remotely without authentication and leads to complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, its high EPSS score and FAUCET Risk Score indicate a substantial potential for future exploitation.