CVE-2026-55083

DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

Published Oct 1, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

Analysis

Technical impact

Unsafe deserialization of Java objects within DHIS2 enables arbitrary code execution. The flaw is classified as CWE-502 and carries a CVSS score of 9.1, indicating that if exploited an attacker can gain full control over the affected system.

Affected Systems

DHIS2 releases from 2.42.0 up to, but not including, 2.42.5.1 and from 2.43.0 up to, but not including, 2.43.0.1 contain the vulnerability. The issue was corrected in releases 2.42.5.1, 2.43.0.1, and later 2.44, so any deployment on a vulnerable version must be upgraded.

Risk and Exploitability

The vulnerability can be triggered remotely from any network location that can reach the Java deserialization endpoint. No authentication is required, so an unauthenticated attacker can send a crafted payload and immediately obtain full code execution, compromising confidentiality, integrity, and availability. With no EPSS metric available and the issue not listed in the CISA KEV catalog, exposure depends mainly on the application’s network reachability and any existing network mitigations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dhis2

dhis2-core

affected

Version	Status	Constraints
`>= 2.42.0, < 2.42.5.1`	affected	—
`>= 2.43.0, < 2.43.0.1`	affected	—

No data.

Vendor Product Versions

Dhis2

Dhis2-core

Version	Status	Scheme	Platform
`[2.42.0,2.42.5.1)`	affected	semver	—
`[2.43.0,2.43.0.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade DHIS2 to 2.42.5.1, 2.43.0.1, or any newer release such as 2.44.
If an immediate upgrade is not possible, restrict external traffic to any API or endpoint that accepts serialized Java objects by configuring firewalls, ACLs, or an application gateway.
As a temporary measure, disable or restrict DHIS2 features that rely on remote import/export or external API calls using Java serialization until a patch is applied.
Run the DHIS2 application under a dedicated low‑privilege system user and enforce strict file system permissions to limit potential damage if an exploit succeeds.

Generated by OpenCVE AI on October 1, 2026 at 20:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.574% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1
https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5

History

Oct 1, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dhis2 Dhis2 dhis2-core
Vendors & Products		Dhis2 Dhis2 dhis2-core

Oct 1, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 1, 2026 6:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
Title		DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
Weaknesses		CWE-502
References		https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1 https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1 https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`