High severity7.2NVD Advisory· Published Aug 13, 2026· Updated Sep 11, 2026
CVE-2026-66256
CVE-2026-66256
Description
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig.
This issue affects Apache Shindig: all versions.
Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/08/13/7nvdMailing ListThird Party Advisory
- lists.apache.org/thread/opgpnhk149614gx6vcy3lvyjnycw8mkhnvdMailing ListVendor Advisory
News mentions
1- Apache Projects Hit by 25 Vulnerabilities in Coordinated August 2026 DisclosureVypr Intelligence · Aug 15, 2026