What is GHSA-hrf9-352c-rrmj?

GHSA-hrf9-352c-rrmj is a security advisory published by GitHub Security Advisories with unknown severity. Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog...

Which CVE IDs does GHSA-hrf9-352c-rrmj cover?

GHSA-hrf9-352c-rrmj covers the following CVE IDs: CVE-2026-123374. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-hrf9-352c-rrmjunknown

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-123374 →

📋 Description

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-123374
https://github.com/apache/roller/pull/236
https://lists.apache.org/thread/577orljt8673gcvcv6nvwo2tnvykyxmt
https://github.com/advisories/GHSA-hrf9-352c-rrmj