PT-2026-43116 · Changmingxie · Tcc-Transaction

Ku4D3 · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-9497

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2026-9497

Affected Products

Tcc-Transaction

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9497 · Security Note
• https://vuldb.com/submit/814092 · Note
• https://vuldb.com/vuln/365480 · Note
• https://github.com/Ku4D3/bug_story/blob/main/report_01.md · Note
• https://vuldb.com/vuln/365480/cti · Note