(axis-axis2-java-core) 01/17: Document CVE-2026-66713 for the removed clustering deserialization issue

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git

commit 173bad188265168bd8ac898aa68f4bbb3d16b7d1
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Mon Jul 27 08:26:03 2026 -1000

    Document CVE-2026-66713 for the removed clustering deserialization issue
    
    Reference the assigned CVE ID and affected-version scope (all releases
    through 2.0.0 on Tomcat, only with Tribes clustering manually enabled,
    fixed in 2.0.1) in the clustering entry of the security threat model.
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 SECURITY.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 902762f0d6..52202c996f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -164,9 +164,13 @@ A previous version of Axis2 included a clustering module for multi-node
 coordination using Apache Tribes. This module exposed a network listener
 that deserialized Java objects from untrusted network streams without
 validation, enabling Remote Code Execution (RCE) via standard
-deserialization gadget chains. Resolved by complete removal of the
-clustering module in 40+ files
-([AXIS2-6097](https://issues.apache.org/jira/browse/AXIS2-6097)).
+deserialization gadget chains. This affected all releases through 2.0.0
+on Apache Tomcat, but only when the Tribes-based clustering feature was
+manually enabled (it was off by default). Assigned
+[CVE-2026-66713](https://www.cve.org/CVERecord?id=CVE-2026-66713) and
+resolved by complete removal of the clustering module in 40+ files
+([AXIS2-6097](https://issues.apache.org/jira/browse/AXIS2-6097)) in
+release 2.0.1.
 
 **Lesson:** Any `ObjectInputStream.readObject()` on network input is a
 critical-severity finding. The remaining use of Java serialization in