Executive brief
tcc-transaction is a distributed transaction management framework used to ensure data consistency across multiple services. A security flaw in how the system handles data storage and retrieval allows an attacker to inject malicious code into the transaction database. If exploited, this could allow an attacker to take full control of the application server, potentially leading to data theft or service disruption.
Technical details
A deserialization vulnerability exists in tcc-transaction up to version 2.1.0. The root cause is the use of 'Fastjson.parseObject' with AutoType enabled when processing transaction data stored in Redis. An attacker with the ability to write to the Redis store—either through the REST API or direct access—can inject a crafted JSON payload containing a '@type' field. When the transaction recovery process later reads and deserializes this data, it triggers arbitrary class instantiation, leading to Remote Code Execution (RCE). While some advisories list this as medium severity, the underlying mechanism is a classic Fastjson AutoType bypass. No official patch is currently available; remediation involves disabling AutoType or implementing a strict type whitelist.
Affected products
- changmingxie tcc-transaction <= 2.1.0
Timeline
- 2026-05-25: disclosed: Initial disclosure via VulDB and NVD
- 2026-05-26: advisory: GitHub Advisory published