HIGH 7.2 NVD
CVE-2026-66256
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.
This issue affects Apache Shindig: all versions.
Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
- https://lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkh
- https://www.openwall.com/lists/oss-security/2026/08/13/7
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-08-13 via NVD.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.