CVE-2026-66256

Description

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Traduire en français

Produits concernés

• Apache Software Foundation Apache Shindig Common
• Apache Software Foundation Apache Shindig Social-Api
• Apache shindig

Scores CVSS

Faiblesses (CWE)

• CWE-502

Références

• https://lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkh Mailing ListVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/08/13/7 Mailing ListThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories