CVE-2022-46366: Apache Tapestry

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

Affected products

• Apache Tapestry: from 3.0.0, before 4.0.0 (fixed in 4.0.0)

Published 2022-12-02. Last modified 2026-06-17.