---
id: "CVE-2026-123374"
page: "https://infrastack.ai/live/CVE-2026-123374"
kind: "vulnerability"
aliases: ["CVE-2026-123374"]
title: "Apache Roller: untrusted ping response can run code on the server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-roller", "java", "runtime", "self-hosted"]
not_affected_if: ["version-6.1.7-or-later"]
published_at: "2026-11-11T13:17:17+00:00"
first_seen_at: "2026-11-11T13:27:12+00:00"
updated_at: "2026-11-11T13:30:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123374", "first_seen_at": "2026-11-11T13:27:12+00:00"}]
exploit_sources: []
---

# Apache Roller: untrusted ping response can run code on the server

Link for people: https://infrastack.ai/live/CVE-2026-123374 (this .md is for agents)

Apache Roller deserializes Java object data from the response of a weblog update ping target, so whoever controls that response can run code in the Roller server process. Affected versions are 4.0 through 6.1.6.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Roller version in use; versions `4.0` through `6.1.6` are affected.
- Confirm whether the server sends weblog update pings (the ping feature is enabled by default in Roller unless disabled; the sources do not say, so unknown).

## Fix

- Apache Roller: upgrade to `6.1.7`, which removes the unsafe deserialization.

## Timeline

- 2026-11-11T13:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123374

## From the sources

Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_