fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE
Critical severity
GitHub Reviewed
Published
Apr 22, 2026
in
hyperledger/fabric
•
Updated Apr 29, 2026
Give feedback on Dependabot alerts