CVE-2024-3366 is a low severity (CVSS 3.5) deserialization flaw in Xuxueli xxl-job up to 2.4.1, in the Template Handler component. The record lists no fixed version. Restrict who can reach the job executor and check the project issue tracker for a patched release.
What's affected
The record says the affected product is xxl-job, the open source distributed job scheduler, in versions up to 2.4.1. The affected function is deserialize in JdkSerializeTool.java, in the com/xxl/job/core/util package, in the Template Handler component. The record says the manipulation leads to injection and that the exploit has been disclosed publicly.
The weaknesses are CWE-502, deserialization of untrusted data, and CWE-74, a general injection class. The NVD vector is CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The attack vector is adjacent network, not the wider internet, and a low privilege account is needed. Integrity impact is low and nothing else is affected, which explains the 3.5 score.
The references are a GitHub issue in the xxl-job repository and the VulDB entry. The issue link returned a 404 error when I loaded it, so I could not confirm the maintainer response or a fix version. The record does not say one exists. It is not marked as exploited in the wild and is not in the CISA KEV list.
How to check if you're exposed
- Find every xxl-job admin and executor you run. Check build files for the
com.xuxueligroup. - In Maven,
mvn dependency:tree | grep xxl-jobshows the version in use. In Gradle, rungradle dependencies | grep xxl-job. - A version at or below 2.4.1 is in scope per the record.
- Check which network the executor listens on. The vector is adjacent network, so exposure depends on who can reach the executor port.
- Check which accounts can create or edit jobs, since a low privilege account is required.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest in the browser and lists known issues for the versions it finds.
What to do now
- Inventory xxl-job usage across your services.
- Keep executor ports on a private network segment and block them from user networks and the internet.
- Reduce the number of accounts that can edit jobs and templates, and review who has them.
- Check the xxl-job releases for a version that addresses the issue and plan the upgrade. The record does not name one.
- Where you control the code that handles serialized data, prefer a data format that cannot carry executable object structure, and apply deserialization filters if you stay on Java serialization.
Why it matters
Java deserialization has a long record of trouble, because turning bytes back into objects can run code that the sender chose. Here the score is low because of where the attacker must sit and what they must hold. A low score does not mean you can ignore the class of bug. If a later flaw in the same area removes the account requirement, the rating would change.
Job schedulers also sit in a sensitive place. They run work on many machines and often hold credentials. For that reason I would rank this above the number on the page for any estate where the scheduler is shared across teams.
Quick check
Is CVE-2024-3366 a remote attack?
The vector is adjacent network, not remote over the internet, and it needs a low privilege account. Exposure depends on who can reach the executor.
Is there a fixed xxl-job version?
The record lists none and the issue page was not available to me. Check the project releases and issue tracker.
Sources
Last reviewed: 19 October 2026.
