CVE-2026-9497 Details
Description
A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A remote code execution vulnerability has been identified in Changmingxie TCC-Transaction versions through 2.1.0. The issue arises from stored deserialization in Redis, where transaction data is serialized using Fastjson with AutoType enabled. An attacker able to write to Redis can inject a crafted JSON payload that triggers arbitrary class instantiation during deserialization, exploiting the Fastjson AutoType REST API.
To address this vulnerability, users should disable AutoType support in Fastjson by setting the global parser configuration to false and enabling safe mode. Additionally, explicit type mapping should be used instead of AutoType. For Redis, it is recommended to require authentication for connections and to restrict access to application servers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 25, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Ku4D3/bug_story/blob/main/report_01.md | [email protected] | ExploitRemedyTechnical Description |
| https://vuldb.com/submit/814092 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365480 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365480/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| changmingxie tcc-transaction | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 25, 2026 | New CVE Received | [email protected] |