Deserialization Vulnerability in Apache Roller by Apache

CVE-2026-82384

What is CVE-2026-82384?

A deserialization vulnerability in Apache Roller 6.1.5 allows unauthenticated remote attackers to exploit the XML-RPC endpoint. This occurs due to the acceptance of vendor extension types that can be deserialized during request parsing before any authentication takes place. Notably, the servlet is mapped unconditionally, permitting parsing to occur even when the global XML-RPC feature is disabled, avoiding the need for non-default configurations. This flaw could potentially allow attackers to execute arbitrary code on the server. Users are advised to upgrade to Apache Roller version 6.1.6 or higher, which disables these extension types and rejects requests when the XML-RPC feature is turned off.

References