{"id":"CVE-2026-123374","kind":"vulnerability","aliases":["CVE-2026-123374"],"related":[],"title":"Apache Roller: untrusted ping response can run code on the server","description":"Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.","summary":"Apache Roller deserializes Java object data from the response of a weblog update ping target, so whoever controls that response can run code in the Roller server process. Affected versions are 4.0 through 6.1.6.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-roller","java","runtime","self-hosted"],"not_affected_if":["version-6.1.7-or-later"],"how_to_check":"- Check the Roller version in use; versions `4.0` through `6.1.6` are affected.\n- Confirm whether the server sends weblog update pings (the ping feature is enabled by default in Roller unless disabled; the sources do not say, so unknown).","fix":"- Apache Roller: upgrade to `6.1.7`, which removes the unsafe deserialization.","status":"open","published_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:30:03+00:00","updated_at":"2026-11-11T13:30:03+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T13:30:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Roller: upgrade to `6.1.7`, which removes the unsafe deserialization.","reach":"network","title":"Apache Roller: untrusted ping response can run code on the server","impact":"high","summary":"Apache Roller deserializes Java object data from the response of a weblog update ping target, so whoever controls that response can run code in the Roller server process. Affected versions are 4.0 through 6.1.6.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-roller","java","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Code runs in the Roller server process","analyst_note":"Confirm from the Apache Roller advisory whether weblog update pings are on by default and whether the attacker must control the ping target.","how_to_check":"- Check the Roller version in use; versions `4.0` through `6.1.6` are affected.\n- Confirm whether the server sends weblog update pings (the ping feature is enabled by default in Roller unless disabled; the sources do not say, so unknown).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-6.1.7-or-later"],"who_is_affected":"Any Apache Roller server from 4.0 through 6.1.6 that sends weblog update pings is exposed, since the flaw is in handling the response from the ping target. The sources do not say whether pings must be enabled by a non-default setting. Teams running Roller 6.1.7 or later, or not running Roller, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4576,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123374':14A,17A '-2026':13A,16A '4.0':57B,112C '6.1.6':59B,114C '6.1.7':122C 'affect':54B,108C 'apach':1A,19B,26B,66C,109C 'apache-rol':18B 'client':79C 'code':8A,48B,100C 'contain':84C 'control':43B,95C 'cve':12A,15A 'data':31B,63C,83C 'deseri':28B,60C,80C,127C 'host':25B 'issu':107C 'java':21B,29B,81C 'object':30B,82C 'parti':93C 'ping':4A,39B,74C,87C 'process':53B,105C 'recommend':117C 'remov':124C 'respons':5A,34B,45B,90C,97C 'roller':2A,20B,27B,51B,67C,69C,103C,110C 'rpc':78C 'run':7A,47B,99C 'runtim':22B 'self':24B 'self-host':23B 'send':70C 'server':11A,52B,104C 'target':40B,88C 'unsaf':126C 'untrust':3A,62C 'updat':38B,73C 'upgrad':119C 'user':115C 'version':55B,121C 'vulner':64C 'weblog':37B,72C 'whoever':42B 'xml':77C 'xml-rpc':76C","nicknames":[],"mitigations":[],"who_affected":"Any Apache Roller server from 4.0 through 6.1.6 that sends weblog update pings is exposed, since the flaw is in handling the response from the ping target. The sources do not say whether pings must be enabled by a non-default setting. Teams running Roller 6.1.7 or later, or not running Roller, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheroller","high","java","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123374':14A,17A '-2026':13A,16A 'apach':1A 'code':8A 'cve':12A,15A 'ping':4A 'respons':5A 'roller':2A 'run':7A 'server':11A 'untrust':3A","search_b":"'4.0':57B '6.1.6':59B 'affect':54B 'apach':19B,26B 'apache-rol':18B 'code':48B 'control':43B 'data':31B 'deseri':28B 'host':25B 'java':21B,29B 'object':30B 'ping':39B 'process':53B 'respons':34B,45B 'roller':20B,27B,51B 'run':47B 'runtim':22B 'self':24B 'self-host':23B 'server':52B 'target':40B 'updat':38B 'version':55B 'weblog':37B 'whoever':42B","search_c":"'4.0':112C '6.1.6':114C '6.1.7':122C 'affect':108C 'apach':66C,109C 'client':79C 'code':100C 'contain':84C 'control':95C 'data':63C,83C 'deseri':60C,80C,127C 'issu':107C 'java':81C 'object':82C 'parti':93C 'ping':74C,87C 'process':105C 'recommend':117C 'remov':124C 'respons':90C,97C 'roller':67C,69C,103C,110C 'rpc':78C 'run':99C 'send':70C 'server':104C 'target':88C 'unsaf':126C 'untrust':62C 'updat':73C 'upgrad':119C 'user':115C 'version':121C 'vulner':64C 'weblog':72C 'xml':77C 'xml-rpc':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123374","severity":null,"published_at":"2026-11-11T13:17:17+00:00","modified_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}