A vulnerability identified as critical has been detected in Apache DolphinScheduler 3.2.x/3.3.0 . This issue affects some unknown processing of the component RPC Handler . Performing a manipulation results in deserialization. This vulnerability is cataloged as CVE-2025-62233 . It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.
Full text archived locally
✦ AI Summary· Claude Sonnet
VDB-359320 · CVE-2025-62233 · GCVE-0-2025-62233
APACHE DOLPHINSCHEDULER 3.2.X/3.3.0 RPC DESERIALIZATION
HISTORYDIFFRELATEJSONXMLCTI
CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score
6.0 $0-$5k 2.50+
Summaryinfo
A vulnerability labeled as critical has been found in Apache DolphinScheduler 3.2.x/3.3.0. Impacted is an unknown function of the component RPC Handler. Executing a manipulation can lead to deserialization. This vulnerability is registered as CVE-2025-62233. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.
Detailsinfo
A vulnerability has been found in Apache DolphinScheduler 3.2.x/3.3.0 and classified as critical. This vulnerability affects an unknown part of the component RPC Handler. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability.
The advisory is shared for download at lists.apache.org. This vulnerability was named CVE-2025-62233. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/24/2026).
Upgrading to version 3.3.1 eliminates this vulnerability.
Productinfo
Type
Social Network Software
Vendor
Apache
Name
DolphinScheduler
Version
3.2.x
3.3.0
License
open-source
Website
Vendor: https://www.apache.org/
CPE 2.3info
🔒
🔒
CPE 2.2info
🔒
🔒
CVSSv4info
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3info
VulDB Meta Base Score: 6.3
VulDB Meta Temp Score: 6.0
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2info
Vector Complexity Authentication Confidentiality Integrity Availability
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploitinginfo
Class: Deserialization
CWE: CWE-502 / CWE-20
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day Unlock Unlock Unlock Unlock
Today Unlock Unlock Unlock Unlock
Threat Intelligenceinfo
Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍
Countermeasuresinfo
Recommended: Upgrade
Status: 🔍
0-Day Time: 🔒
Upgrade: DolphinScheduler 3.3.1
Timelineinfo
04/24/2026 Advisory disclosed
04/24/2026 +0 days VulDB entry created
04/24/2026 +0 days VulDB entry last update
Sourcesinfo
Vendor: apache.org
Advisory: lists.apache.org
Status: Confirmed
CVE: CVE-2025-62233 (🔒)
GCVE (CVE): GCVE-0-2025-62233
GCVE (VulDB): GCVE-100-359320
Entryinfo
Created: 04/24/2026 08:04
Changes: 04/24/2026 08:04 (52)
Complete: 🔍
Cache ID: 99:693:101
Discussion
No comments yet. Languages: en.
Please log in to comment.
◂ PreviousOverviewNext ▸