Deserialization Of Untrusted Data

Spring Statemachine is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Kryo-based persistence backends deserializing persisted state-machine contexts without enforcing a class allowlist, which allows an attacker to provide malicious serialized data and potentially...

GHSA-85QJ-F5WG-RWP9 Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

org.springframework.statemachine:spring-statemachine-cluster (>=3.2.0, <=3.2.1), org.springframework.statemachine:spring-statemachine-data-common (>=3.2.0, <=3.2.1) +10 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=3.2.0, <=3.2.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2026-41862 Source advisory: OSV:GHSA-85QJ-F5WG-RWP9https://vulners.com/osvghsa/OSV...

org.springframework.statemachine:spring-statemachine-cluster (>=3.2.0, <=3.2.1), org.springframework.statemachine:spring-statemachine-data-common (>=3.2.0, <=3.2.1) +10 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=3.2.0, <=3.2.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2026-41862 Source advisory: GHSA-85QJ-F5WG-RWP9https://vulners.com/github/GHSA-85QJ...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

CVE-2026-41862 affects Spring Statemachine Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) which deserialize persisted StateMachineContext without a class allowlist. This can enable a gadget chain leading to remote code execution inside the application JVM. Affected versions a...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

EUVD-2026-38596

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862: Deserialization of Untrusted Data

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

PT-2026-51593

Name of the Vulnerable Software and Affected Versions Spring Statemachine versions 4.0.0 through 4.0.1 Spring Statemachine versions 3.2.0 through 3.2.4 Description Kryo-based persistence backends, including JPA, MongoDB, Redis, and ZooKeeper, deserialize persisted state-machine contexts without...

org.springframework.statemachine:spring-statemachine-samples-datapersist (4.0.0), org.springframework.statemachine:spring-statemachine-samples-eventservice (4.0.0) potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-redis (4.0.0)

org.springframework.statemachine:spring-statemachine-data-redis MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.statemachine:spring-statemachine-data-redis and may be impacted: -...

org.springframework.statemachine:spring-statemachine-samples-datapersist (4.0.0) potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-mongodb (4.0.0)

org.springframework.statemachine:spring-statemachine-data-mongodb MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.statemachine:spring-statemachine-data-mongodb and may be impacted: -...

Deserialization of Untrusted Data

Overview org.springframework.statemachine:spring-statemachine-core is a Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The Kryo-based persistence serializers KryoStateMachineSerialisationService / AbstractKryoStateMachineSerialisationService deserialise...