Cyber Resilience

CVE-2021-30180

Apache Dubbo 2.7.0 – 2.7.10

High EPSS
Published
01 June 2021
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.60 99.1th percentile
Risk Priority 90 floored blend · peak EPSS

Summary

CVE-2021-30180 is a critical-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Apache Dubbo. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When…

more

parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
YAML rule parsing flaw allows remote attackers to invoke arbitrary constructors on a publicly exposed Dubbo service.
T1203 Exploitation for Client Execution Executionconfidence: MEDIUM
Successful exploitation can lead to arbitrary code execution on the server when a crafted request is processed.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2021-30181Same product: Apache Dubbo
CVE-2023-23638Same product: Apache Dubbo
CVE-2023-46279Same product: Apache Dubbo
CVE-2023-29234Same product: Apache Dubbo
CVE-2024-32638Same vendor: Apache
CVE-2025-65114Same vendor: Apache
CVE-2023-25690Same vendor: Apache
CVE-2024-53868Same vendor: Apache
CVE-2024-23452Same vendor: Apache
CVE-2023-33934Same vendor: Apache

Affected Assets

apache
dubbo
2.7.0 — 2.7.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V4.1.3
  • V4.2.4
  • V1.5.3
  • V4.1.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Configuration management can enforce uniform HTTP parsing rules across intermediaries, directly mitigating inconsistent interpretation.

DE.CM-01 partial match
prevents

Network monitoring can detect smuggling attempts via anomalous HTTP traffic or logs, while eliminating the inconsistency directly aids detection of such events.

PR.IR-01 partial match
prevents

Network protections can enforce consistent HTTP proxy/firewall behavior to block smuggling, and removing the weakness helps prevent unauthorized access via request smuggling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect HTTP request smuggling vulnerabilities in intermediary components.

degrades

Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.

degrades

Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.

prevents

Secure SDLC practices require threat modeling and testing for HTTP parsing inconsistencies in intermediaries.

prevents

Application security requirements can mandate strict HTTP message validation and canonicalization.

prevents

Secure architecture principles include consistent protocol handling and defense-in-depth for proxies.

References