---
id: CVE-2026-55083
title: >-
  DHIS2 is a flexible information system for data capture, management,
  validation, analytics and visualization
summary: >-
  DHIS2 is a flexible information system for data capture, management,
  validation, analytics and visualization. From versions 2.42.0 to before
  2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to
  remote code execut…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-502
vendor: dhis2
product: dhis2-core
affected:
  - 'dhis2-core >= 2.42.0, < 2.42.5.1'
  - 'dhis2-core >= 2.43.0, < 2.43.0.1'
published: '2026-10-01'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:53:46.583'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55083'
references:
  - url: 'https://github.com/dhis2/dhis2-core/releases/tag/2.42.5.1'
    label: security-advisories@github.com
  - url: 'https://github.com/dhis2/dhis2-core/releases/tag/2.43.0.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3fr2-wvqx-cmr5
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00574
epssPercentile: 0.47203
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T18:30:31.099135Z'
ingestedAt: '2026-10-01T18:55:42.390Z'
---

## Overview

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.