CVE-2026-4735

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4735
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4735.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4735
Published
2026-03-24T03:08:18.156Z
Modified
2026-08-12T16:25:23.265956Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Amber CVSS Calculator
Summary
A stack overflow and DoS vulnerability in DTStack/chunjun
Details

Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java.

This issue affects chunjun: before 1.16.1.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4735.json",
    "cna_assigner": "GovTech CSG"
}
References

Affected packages

Git / github.com/dtstack/chunjun

Affected ranges

Type
GIT
Repo
https://github.com/dtstack/chunjun
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cff5fbffb498a60e0fb700f77073deeebb7ed3e6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.16.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

r1.*
r1.5.0
r1.5.2
r1.8.0
r1.8.1
v1.*
v1.12.3
v1.12.4
v1.12.5
v1.12.7
v1.12.8
v1.5.2

Database specific

vanir_signatures_modified 
"2026-08-12T16:25:23Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-4735-13712ce1",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 352.0,
            "function_hash": "279906687212391003223050923325117445468"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "KafkaSyncConverter",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java"
        }
    },
    {
        "id": "CVE-2026-4735-2b8e9bfb",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 151.0,
            "function_hash": "14961469517989358436422224190899541383"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "KafkaSyncKeyConverter",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java"
        }
    },
    {
        "id": "CVE-2026-4735-392dcb18",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 52.0,
            "function_hash": "165298536957404862989778058946343504125"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "KafkaSyncKeyConverter",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java"
        }
    },
    {
        "id": "CVE-2026-4735-8a14a27b",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "27472061896725043440778360417776024772",
                "247069045381520611208605095891834476027",
                "298195100281213533677464829243118271053",
                "176801034395515347506893324939960013194",
                "44126896738637099335260850491877858755",
                "297378463328241894296155043587339169990",
                "281046937688404527109161605516599767075",
                "40298537806385345844602257512649948235",
                "79219918838423812059708120517868504147",
                "65147302998449949520680222882592322174",
                "336757479202988604787560270897414188722",
                "46595710293519128876697565867554982482",
                "103865943392787861144461546601764417688",
                "287220643454365684291923236833435013663"
            ]
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncKeyConverter.java"
        }
    },
    {
        "id": "CVE-2026-4735-963842d7",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1485.0,
            "function_hash": "318255106755676667030630912824802511112"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "createOutput",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/sink/KafkaSinkFactory.java"
        }
    },
    {
        "id": "CVE-2026-4735-b3232cad",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1131.0,
            "function_hash": "41397982107967171119722267885701428859"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "createSource",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/source/KafkaSourceFactory.java"
        }
    },
    {
        "id": "CVE-2026-4735-cae4af92",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "101717256150954230054909639610770333585",
                "286628152737368014138819779411984933884",
                "229133547977017232974810006928191050471",
                "37544693163321652162476396347563597075",
                "314394844917759658532232977844308496430",
                "31195505722641946345247899788093766208",
                "31210111341283022086561802029302372084",
                "295243085941699209895953411764395492254",
                "160843761853243261581803069490671800810",
                "326084103185048218331640584574065347088",
                "100643146002224403029696469702950558678",
                "92175172678751775020752650032237996193",
                "26065577305130728529038777292794258574",
                "292762933396227637003357008216390050026"
            ]
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java"
        }
    },
    {
        "id": "CVE-2026-4735-d2bf9789",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "6158041935588308093385177773257176557",
                "310862284039913157826440302377508860016",
                "228676624695947347715534049197030072551",
                "333554729478656867203834173287037504563",
                "204335762952903595962534342966240590145",
                "268387031900797246460199159345426967913",
                "45814502169441225898448753155793946496",
                "83360823220175707338854578383878608437",
                "31319183621399506427760032520964789031",
                "11708635858127335391340874892496361568",
                "190440478496648337784724154648897555309",
                "201426660522518771270666924947013732383",
                "142878359944423747755849045403465154864",
                "65550291800990674967875750758770963710",
                "242361556861645650526696982187480303576",
                "28069137344552139560470997066388902716",
                "76336680946900526713332345378205036160",
                "5962923548377693907383724983596227503",
                "40397492080743711986548965896708986132",
                "107354507051482376719592582656144860989",
                "274225348374054510432941255424991356851",
                "244550020315157905906035560896606407580",
                "290844737857653336281577297897147513388",
                "222170885541675270269338580915773502721"
            ]
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/sink/KafkaSinkFactory.java"
        }
    },
    {
        "id": "CVE-2026-4735-d87875b7",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "190293109800794163770011188678798136072",
                "41928740038261452077526103916897313061",
                "62142214413743892811568159258823571881",
                "131503575994614813282279556093127640555"
            ]
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/source/KafkaSourceFactory.java"
        }
    },
    {
        "id": "CVE-2026-4735-fa3e0db1",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 759.0,
            "function_hash": "94954219588609495378131824294805417688"
        },
        "source": "https://github.com/dtstack/chunjun/commit/cff5fbffb498a60e0fb700f77073deeebb7ed3e6",
        "target": {
            "function": "KafkaSyncConverter",
            "file": "chunjun-connectors/chunjun-connector-kafka/src/main/java/com/dtstack/chunjun/connector/kafka/converter/KafkaSyncConverter.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4735.json"