DHIS2 core: Remote code execution via unsafe Java deserialization

Summary

DHIS2 core versions 2.42.0 to before 2.42.5.1 and 2.43.0 to before 2.43.0.1 are affected by unsafe Java deserialization of untrusted data (CWE-502). An attacker who can reach the vulnerable functionality can execute arbitrary code on the server, which can lead to full compromise of the system and its data. The CNA record requires high privileges (PR:H), but the vendor advisory states low privileges (PR:L) with high complexity, so the exact preconditions are disputed and should be treated conservatively.

Affected

• DHIS2 core 2.42.0 to before 2.42.5.1
• DHIS2 core 2.43.0 to before 2.43.0.1
• Versions below 2.42.0: not covered by the sources
• 2.44: the vendor advisory lists the development branch before PR #24162 as affected; the CNA record does not list 2.44. Unclear.

Fixed in

• 2.42.5.1
• 2.43.0.1
• 2.44 (confirm with the vendor that the released 2.44 build contains the fix)

Workaround

• No vendor-verified workaround is documented. Patching is the only fix described.
• Generic measures from a third-party guide, not verified by the vendor: isolate DHIS2 in a segmented network zone, restrict inbound access to trusted IP ranges, and apply egress filtering.

Exploitation

• No evidence of exploitation in the wild found. Not listed as known exploited (KEV) by the sources checked.
• No public proof-of-concept found at time of research; the analyses may be out of date.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Identify all DHIS2 instances and their exact versions, including test and training servers.
• Upgrade to 2.42.5.1, 2.43.0.1 or 2.44 according to the vendor advisory, and confirm the 2.44 build is fixed.
• If patching is delayed, restrict access to trusted networks and review admin and user accounts.
• Check whether DHIS2 is reachable from the internet; if so, treat it as urgent.
• Review logs for unusual process creation, outbound connections and file changes on the DHIS2 host.
• Check for the related SQL injection CVE-2026-55084 in the same update cycle.
• Recheck NVD, CISA KEV and the GitHub advisory weekly, as the NVD analysis was pending and the CVSS vector is not settled.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-3fr2-wvqx-cmr5 github.com
• DHIS2 release 2.42.5.1 github.com
• DHIS2 release 2.43.0.1 github.com
• OSV entry CVE-2026-55083 osv.dev
• VulDB CVE-2026-55083 vuldb.com
• TheHackerWire CVE-2026-55083 analysis www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:45.