PT-2026-43116 · Changmingxie · Tcc-Transaction

Ku4D3 · Publicado 2026-05-25 · Atualizado 2026-05-25 · CVE-2026-9497

Mitre

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

CVE-2026-9497

Produtos afetados

Tcc-Transaction

Referências · 5

• https://vuldb.com/submit/814092 · Nota
• https://vuldb.com/vuln/365480 · Nota
• https://github.com/Ku4D3/bug_story/blob/main/report_01.md · Nota
• https://vuldb.com/vuln/365480/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9497 · Nota de Segurança