CVE-2026-55083
CriticalCVSS 9.1Summary
DHIS2 versions from 2.42.0 to before 2.42.5.1, and from 2.43.0 to before 2.43.0.1, are vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
Risk Assessment
Remote code execution can lead to full compromise of the DHIS2 system and medical data.
Recommendation
Update DHIS2 to one of the patched versions: 2.42.5.1, 2.43.0.1, or 2.44.
Other vulnerabilities in DHIS2
See all- CVE-2026-55084High
DHIS2 (versions 2.37-2.44) contains a SQL injection vulnerability in the SqlView API endpoint. An authenticated user with SqlView access can inject arbitrary SQL queries via the filter parameter by abusing a PostgreSQL expression, with output reflected in error messages.
- CVE-2026-55082High
Vulnerability in DHIS2 SQL View data endpoints. Authenticated users with SQL View access can provide crafted filter values that are interpolated into generated SQL, potentially accessing data outside the intended result set.
- CVE-2026-55081High
XSS vulnerability in DHIS2 versions 2.42 and 2.43 before the 2026-06-09 security patches, and in the 2.44 development branch. An attacker can inject active HTML or JavaScript via the scope parameter in the OpenAPI HTML endpoint.
Original NVD description (English source)
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS