Hyperledger Fabric versions 1.0.0 through 2.2.26 use a Java ObjectInputStream to deserialize channel data without applying an ObjectInputFilter. This classic deserialization flaw allows an attacker to provide crafted serialized objects that, when processed by deSerializeChannel, execute arbitrary code on the Fabric node, compromising confidentiality, integrity, and availability of the entire ledger.

Vulnerable components are found in the Hyperledger Fabric framework, specifically the Channel.java implementation used by fabric-sdk-java. All releases from 1.0.0 up to 2.2.26 are affected; newer releases beyond 2.2.26 are presumed to have mitigations.

The CVSS score of 9.3 indicates a critical severity. Although no EPSS score is available and the issue is not listed in the CISA KEV catalog, the vulnerability follows a well‑known remote code execution pattern. An attacker with the ability to send arbitrary byte arrays to a Fabric channel—either through compromised SDK clients or malicious network traffic—can exploit the flaw. Proper configuration of a deserialization filter or upgrading to a non‑vulnerable version are the only known mitigations.