GitHub Advisoryadvisory · Maven

GHSA-4r4v-3jc5-hrg9 TCC-TRANSACTION has an Improper Input Validation vulnerability

LOW Published 2026-05-26 Modified 2026-06-30 Official page ↗
Aliases
CVE-2026-9497
Ecosystem
Maven
Packages
org.mengyun:tcc-transaction
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20
Reviewed
2026-06-30

Affected packages

• Maven org.mengyun:tcc-transaction: <= 2.1.0 (no fix yet)

Description

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-9497 A flaw has been found in changmingxie tcc-transaction up to 2.1.0. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References