CVEvulnerability

CVE-2026-55083

9.1 CRITICAL Published 2026-10-01 Modified 2026-10-02 Official page ↗

Status: Awaiting Analysis
Published: 2026-10-01
Last modified: 2026-10-02
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-502

Description

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References

https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1 github.com
https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1 github.com
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5 github.com

CVE-2026-55083

Description

Related

Weakness · CWE (1)

References