CVE-2026-41586criticalCWE-502

CVE-2026-41586: fallo crítico en hyperledger fabric

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Publicada el

Seguir esta CVE+ Monitorear fabric+ Monitorear org.hyperledger.fabric-sdk-java:fabric-sdk-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.5%
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
hyperledger · fabric
CVEs relacionadas — hyperledger fabric

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-31121HIGHImproper Input Validation in fabric hyperledgerEPSS 2.1%CVE-2022-36023HIGHRemote denial of service in Hyperledger Fabric GatewayEPSS 1.1%CVE-2023-46132HIGHCrosslinking transaction attack in hyperledger/fabricEPSS 0.5%