PT-2025-6724 · Apache · Apache Eventmesh

Au5T1N + 3 · Published 2025-02-14 · Updated 2026-03-10 · CVE-2024-56180

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache EventMesh versions prior to 1.11.0

Description The issue concerns the deserialization of untrusted data at the eventmesh-meta-raft plugin module in Apache EventMesh, allowing attackers to send controlled messages and execute remote code via the Hessian deserialization RPC protocol. This affects platforms such as Windows, Linux, and Mac OS.

Recommendations For versions prior to 1.11.0, users can use the code under the master branch in the project repository or update to version 1.11.0 to fix this issue. As a temporary workaround, consider restricting access to the vulnerable eventmesh-meta-raft plugin module until a patch is available.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-56180

GHSA-FFVR-GMP3-XX43

Affected Products

Apache Eventmesh

References · 14

• https://ubuntu.com/security/CVE-2024-56180 · Vendor Advisory
• https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffvr-gmp3-xx43 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-56180 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56180 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-56180 · Vendor Advisory
• https://github.com/apache/eventmesh · Note
• https://t.me/cvenotify/111376 · Telegram Post
• https://twitter.com/CVEnew/status/1890411283943399640 · Twitter Post
• https://twitter.com/oss_security/status/1890587625251025100 · Twitter Post
• https://t.me/cvedetector/18109 · Telegram Post
• https://t.me/cvenotify/128839 · Telegram Post
• http://openwall.com/lists/oss-security/2025/02/14/7 · Note