CVE-2026-55083

CVSS 9.1 (critical) · published 2026-10-01

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

Weakness: CWE-502

Source: NVD CVE-2026-55083

References

• https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1
• https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1
• https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.