CVE-2025-62233: Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and <…

PriorityP342medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

EPSS

0.54%

41.4th percentile

Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	dolphinscheduler	>= 3.2.0 < 3.3.1	3.3.1
apache_software_foundation	apache_dolphinscheduler	>= 3.2.0 < 3.3.1	3.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.