This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit 173bad188265168bd8ac898aa68f4bbb3d16b7d1 Author: Robert Lazarski <[email protected]> AuthorDate: Mon Jul 27 08:26:03 2026 -1000 Document CVE-2026-66713 for the removed clustering deserialization issue Reference the assigned CVE ID and affected-version scope (all releases through 2.0.0 on Tomcat, only with Tribes clustering manually enabled, fixed in 2.0.1) in the clustering entry of the security threat model. Co-Authored-By: Claude Opus 4.8 <[email protected]> --- SECURITY.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 902762f0d6..52202c996f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -164,9 +164,13 @@ A previous version of Axis2 included a clustering module for multi-node coordination using Apache Tribes. This module exposed a network listener that deserialized Java objects from untrusted network streams without validation, enabling Remote Code Execution (RCE) via standard -deserialization gadget chains. Resolved by complete removal of the -clustering module in 40+ files -([AXIS2-6097](https://issues.apache.org/jira/browse/AXIS2-6097)). +deserialization gadget chains. This affected all releases through 2.0.0 +on Apache Tomcat, but only when the Tribes-based clustering feature was +manually enabled (it was off by default). Assigned +[CVE-2026-66713](https://www.cve.org/CVERecord?id=CVE-2026-66713) and +resolved by complete removal of the clustering module in 40+ files +([AXIS2-6097](https://issues.apache.org/jira/browse/AXIS2-6097)) in +release 2.0.1. **Lesson:** Any `ObjectInputStream.readObject()` on network input is a critical-severity finding. The remaining use of Java serialization in
