CVE-2026-9497: TCC-TRANSACTION has an Improper Input Validation vulnerability

May 26, 2026 (updated June 30, 2026)

A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST API. This manipulation causes deserialization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

References

github.com/Ku4D3/bug_story/blob/main/report_01.md
github.com/advisories/GHSA-4r4v-3jc5-hrg9
nvd.nist.gov/vuln/detail/CVE-2026-9497
vuldb.com/submit/814092
vuldb.com/vuln/365480
vuldb.com/vuln/365480/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-9497 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →