CVE-2021-33790
9.8
CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.84% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-05-31 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| minecraft | minecraft |
| techreborn | reborncore |
References
- https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrm
- https://vuln.ryotak.me/advisories/45
- https://www.curseforge.com/minecraft/mc-mods/reborncore
- https://github.com/TechReborn/RebornCore/security/advisories/GHSA-r7pg-4xrf-7mrm
- https://vuln.ryotak.me/advisories/45
- https://www.curseforge.com/minecraft/mc-mods/reborncore
→ the Explorer · watch your stack · NVD