Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sofastack/sofa-rpc

              master @ aced81f
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Deserialization: 2 prior fixes. Scrutinize any change in this area.

codec-sofa-fory: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization: Unrestricted deserialization of Java objects via the Hessian codec allows remote attackers to execute arbitrary code. The project has had to continuously patch specific gadget classes such as javax.sound.sampled.AudioFileFormat.

Deserialization of Untrusted Data: The core SOFA-RPC serialization API is vulnerable to RCE if the centralized blocklist is not comprehensively updated against newly discovered Java gadget chains.

Deserialization: The Apache Fory-based serializer required the addition of configurable class validation modes (STRICT and WARN checker modes) via AllowListChecker to stop unsafe object deserialization.