VYPR
Get started
← All advisories
Critical severityGHSA Advisory· Published May 7, 2026· Updated May 7, 2026

CVE-2026-41586

CVE-2026-41586

Description

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.hyperledger.fabric-sdk-java:fabric-sdk-javaMaven
>= 1.0.0, <= 2.2.26—

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

11