CVE-2016-1000027
Deserialization of Untrusted Data: Is CVE-2016-1000027 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Moderate signals. Triage by your actual exposure and reachability.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2016-1000027)<a href="https://www.truepositive.app/cve/CVE-2016-1000027"><img src="https://www.truepositive.app/cve/CVE-2016-1000027/badge.svg" alt="TruePositive verdict for CVE-2016-1000027"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is False positive / noise — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
This is the textbook dependency-scanner false positive. The flaw is only real if your app actually exposes Spring's HttpInvokerServiceExporter or a similar remoting exporter and deserializes attacker-controlled data, which is a style of remoting that almost nobody uses today. But the class ships inside spring-web, so software composition scanners flag every Spring application as critical whether or not the vulnerable endpoint exists. Spring's maintainers long declined to treat it as a framework vulnerability for this exact reason.
How to check: search your code for HttpInvokerServiceExporter or RemoteInvocationSerializingExporter. If there is none, the vulnerable path does not exist in your app.
Commonly flagged by: Snyk, Dependabot, Trivy, OWASP Dependency-Check.
- 0
The other side: do not get complacent. If you do expose a Spring HTTP Invoker endpoint, or any code that reads Java serialized objects from untrusted input, this is a genuine unauthenticated remote code execution. The false-positive verdict is for the large majority who only carry the dependency, not for the few who actually use remoting.
- 0
If you do not use HTTP Invoker remoting, which is almost certain, suppress or accept the finding with a short written justification rather than spending a sprint on it. If you do use it, remove the exporter or move off Java serialization. Spring 6 removed the legacy remoting support entirely.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-502 · Deserialization of Untrusted Data.
- CVE-2021-35464CRIT 9.8KEVEPSS 100%
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
- CVE-2023-0669HIGH 7.2KEVEPSS 100%
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- CVE-2023-29300CRIT 9.8KEVEPSS 100%
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- CVE-2025-53770CRIT 9.8KEVEPSS 100%
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- CVE-2022-41082HIGH 8KEVEPSS 100%
Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2022-47986CRIT 9.8KEVEPSS 100%
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.