Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.dolphinscheduler:dolphinscheduler-rpc

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3MavenPublished

    Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability

    CVE-2025-62233 · GHSA-f786-9c63-8xr8

    Affected
    • Maven org.apache.dolphinscheduler:dolphinscheduler-rpc >= 3.2.0, < 3.3.1
    Fixed in
    3.3.1· Vendor fix available
    Issue
    Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version = 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue.

    Recommended action: Upgrade to 3.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →