This vulnerability involves unsafe deserialization in the Hessian2Input.readObject method within the xxl-rpc Listener component of alldatacenter alldata. Versions 0.6.0 through 0.6.8 are affected. The flaw allows remote attackers to manipulate serialized data, potentially leading to deserialization attacks. The issue was publicly disclosed with exploit code available. The vendor has explicitly stated that no fix is planned, leaving the vulnerability unpatched.

Successful exploitation can lead to remote deserialization attacks, which may allow attackers to execute arbitrary code or cause denial of service depending on the application context. Given the CVSS 4.0 score of 6.9 (medium severity), the impact is significant but not critical. No known exploits in the wild have been reported beyond the public exploit availability.

No official fix or patch is available as the vendor has closed the issue report as "not planned." Users should consider alternative mitigations such as disabling or restricting the vulnerable component if possible, applying network-level protections to limit exposure, or migrating to alternative software. Patch status is not yet confirmed; check the vendor advisory for any future updates.