Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

MEDIUM 6.3CVE-2024-39954 · GHSA-hf86-8x8v-h7vc · Published 20/08/2025 · updated 17/06/2026

In short

CVE-2024-39954 is a MEDIUM (CVSS 6.3) vulnerability affecting org.apache.eventmesh:eventmesh-runtime, eventmesh (apache).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.9% of all vulnerabilities.
Fix: update to 1.12.0 or later.

Package	Affected versions	Patched versions
org.apache.eventmesh:eventmesh-runtime Maven	`≥ 1.6.0-release, ≤ 1.11.0-release`	No fix yet
eventmesh apache	`< 1.12.0`	`1.12.0`

Description

Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes this issue.

NVD description

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

References

nvd.nist.gov/vuln/detail/CVE-2024-39954 · ADVISORY
apache/eventmesh · PACKAGE
lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free