CVE-2022-39198

Critical

Advisory

Published 19 Oct 2022In the index since 9 Sept 2026

Hessian Lite for Apache Dubbo deserialization vulnerability

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
dubbomaven	2.7.8	2.7.18	1
hessian-litemaven	3.2.8	3.2.13	1

3 by stars

Chart

Latest

Affected images

Radar Score

1 of the 2 container images this version deploys carry CVE-2022-39198.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	dubbo@2.7.8 hessian-lite@3.2.8	2.7.18 3.2.13

12,513

shenyushenyu-helm-chart-test

1 of the 2 container images this version deploys carry CVE-2022-39198.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	dubbo@2.7.8 hessian-lite@3.2.8	2.7.18 3.2.13

12,513

shenyutest-helm

1 of the 2 container images this version deploys carry CVE-2022-39198.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	dubbo@2.7.8 hessian-lite@3.2.8	2.7.18 3.2.13

12,513

1 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/shenyu-bootstrap :2.4.2	0bd3b25c4be4	dubbo@2.7.8 hessian-lite@3.2.8	2.7.18 3.2.13	3