CVE-2026-9497: TCC-Transaction RCE Vulnerability

CVE-2026-9497 Overview

CVE-2026-9497 is an insecure deserialization vulnerability in changmingxie tcc-transaction through version 2.1.0. The flaw resides in the Fastjson.parseObject function within the Fastjson AutoType REST API component. Attackers can manipulate object deserialization remotely without local access, leveraging Fastjson's AutoType feature to instantiate arbitrary classes during JSON parsing. The vendor was contacted prior to public disclosure but did not respond. This issue is tracked under [CWE-20] Improper Input Validation.

Critical Impact
Remote attackers with low privileges can trigger unsafe deserialization through the REST API, potentially leading to object injection and downstream code execution depending on classpath gadgets.

Affected Products

changmingxie tcc-transaction versions up to and including 2.1.0
Applications embedding the vulnerable Fastjson AutoType REST API component
Java services using Fastjson.parseObject against untrusted input in tcc-transaction

Discovery Timeline

2026-05-25 - CVE-2026-9497 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9497

Vulnerability Analysis

The vulnerability stems from unsafe use of Fastjson.parseObject inside the tcc-transaction REST API. Fastjson's AutoType feature allows JSON payloads to specify a target Java class through the @type field. When AutoType is enabled or insufficiently restricted, the parser instantiates attacker-controlled classes during deserialization. This behavior turns inbound JSON into a vehicle for object injection.

Because the REST API accepts remote input and forwards it directly to the parser, an unauthenticated network path exposes the gadget surface. Exploitation success depends on the runtime classpath. If known Fastjson deserialization gadgets are present, attackers can pivot from object instantiation to side effects such as JNDI lookups or method invocations. The vendor's lack of response increases the window of exposure for downstream consumers.

Root Cause

The root cause is improper input validation [CWE-20] in the JSON parsing path. Fastjson.parseObject is invoked on untrusted REST payloads without disabling AutoType or applying a strict allowlist of permitted classes. Earlier Fastjson releases include known AutoType bypasses, compounding the risk when the embedded library is not pinned to a hardened version.

Attack Vector

The attack vector is network-based. An attacker sends a crafted JSON body containing an @type directive to the vulnerable REST endpoint. The server deserializes the payload through Fastjson.parseObject, instantiating the specified class and invoking its setters or constructors. Technical reproduction details are documented in the GitHub Bug Report Document and VulDB Vulnerability #365480.

No verified public proof-of-concept code is mirrored here. Refer to the linked report for payload structure and reproduction steps.

Detection Methods for CVE-2026-9497

Indicators of Compromise

Inbound HTTP requests to tcc-transaction REST endpoints containing the @type JSON field
JSON payloads referencing classes such as com.sun.rowset.JdbcRowSetImpl, org.springframework, or other known Fastjson gadgets
Outbound JNDI, LDAP, or RMI connections originating from the tcc-transaction JVM process shortly after REST calls
Unexpected child processes or class loading events in the Java runtime hosting tcc-transaction

Detection Strategies

Inspect web application firewall and proxy logs for JSON bodies containing @type directed at tcc-transaction routes
Enable verbose Fastjson logging to surface AutoType deserialization attempts and rejected class loads
Hunt for anomalous outbound connections from application servers correlated with REST API access patterns
Cross-reference inbound request patterns with the gadget signatures published in the VulDB CTI for #365480

Monitoring Recommendations

Forward application, WAF, and JVM logs to a centralized analytics platform and alert on @type token frequency
Baseline normal REST traffic to tcc-transaction and alert on payload size or structure deviations
Monitor classpath load events for unusual Class.forName activity triggered by HTTP request threads

How to Mitigate CVE-2026-9497

Immediate Actions Required

Restrict network exposure of tcc-transaction REST endpoints to trusted internal callers only
Disable Fastjson AutoType globally where not strictly required by application logic
Apply a strict allowlist of deserializable classes if AutoType cannot be disabled
Audit deployed tcc-transaction instances for version 2.1.0 and earlier

Patch Information

No vendor patch is available at the time of writing. The project maintainer did not respond to disclosure outreach. Consumers should track the upstream tcc-transaction repository for fixes and consider forking or replacing the component if a fix is not forthcoming. Additional submission context is available in VulDB Submission #814092.

Workarounds

Upgrade the embedded Fastjson dependency to a version with safeMode support and enable ParserConfig.getGlobalInstance().setSafeMode(true)
Place a reverse proxy or WAF in front of the REST API to drop JSON bodies containing @type
Replace Fastjson.parseObject with a deserializer that does not perform polymorphic type resolution from untrusted input
Run the tcc-transaction JVM under a least-privilege service account with egress filtering

bash

# Example: enable Fastjson safeMode at JVM startup
java -Dfastjson.parser.safeMode=true \
     -jar tcc-transaction-service.jar

# Example: WAF rule snippet to block AutoType payloads
SecRule REQUEST_BODY "@rx \"@type\"\\s*:" \
    "id:9497001,phase:2,deny,status:400,msg:'Fastjson AutoType blocked'"