CVE-2026-41586criticalCWE-502

CVE-2026-41586: falha crítica em hyperledger fabric

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Publicada em

Seguir esta CVE+ Monitorar fabric+ Monitorar org.hyperledger.fabric-sdk-java:fabric-sdk-java

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.5%
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
hyperledger · fabric
CVEs relacionadas — hyperledger fabric

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31121HIGHImproper Input Validation in fabric hyperledgerEPSS 2.1%CVE-2022-36023HIGHRemote denial of service in Hyperledger Fabric GatewayEPSS 1.2%CVE-2023-46132HIGHCrosslinking transaction attack in hyperledger/fabricEPSS 0.5%