ECHO-fbdf-61c2-28f4
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-fbdf-61c2-28f4.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-fbdf-61c2-28f4
- Upstream
- Withdrawn
- 2026-11-12T08:00:07Z
- Published
- 2022-05-24T17:05:30Z
- Modified
- 2026-11-12T08:20:30Z
- Summary
- Java deserialization in HttpInvokerServiceExporter / RemoteInvocationSerializingExporter (spring-web remoting). Upstream never code-fixed this on any line: the classes were deprecated in 5.3.0 and removed in 6.0.0, so there is no fix commit to backport. Replicating the 6.0 removal would break the API this drop-in build must keep, so the classes ship unchanged, as in the 5.3.32 and 5.3.39 specs (which record this as a comment).
- Details
- References