cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist

cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

org.springframework.statemachine:spring-statemachine-cluster (>=4.0.0, <=4.0.1), org.springframework.statemachine:spring-statemachine-samples-web (4.0.0) +1 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-zookeeper (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-zookeeper MAVEN version =4.0.0, =4.0.0, =4.0.1 - org.springframework.statemachine:spring-statemachine-samples-web 4.0.0 - org.springframework.statemachine:spring-statemachine-samples-zookeeper 4.0.0 Source cves: CVE-2026-41862 Source advisory:...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +3 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-jpa (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-data-jpa MAVEN version =4.0.0, =0.0.1, =100.260315.1, =100.260611.0 - org.springframework.statemachine:spring-statemachine-samples-datajpa 4.0.0 - org.springframework.statemachine:spring-statemachine-samples-datajpamultipersist 4.0.0 -...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), com.brihaspathee.zeus:account-processor (>=1.0.4, <=1.0.9) +41 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-core (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-core MAVEN version =4.0.0, =0.0.1, =1.0.4, =1.0.3, =1.1.0, =100.260315.1, =2025.02, =2025.02, =2025.02, =2024.12.24, =2024.12.24, =4.0.0, =4.0.0, =4.0.0, =4.0.1 and more Source cves: CVE-2026-41862 Source advisory: SNYK:JAVA-ORGSPRING...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +8 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-common (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-data-common MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.1 - org.springframework.statemachine:spring-statemachine-samples-datajpa 4.0.0 -...

in.clouthink.daas:daas-fss-gridfs (>=3.0.5, <=3.0.7), org.springframework.boot:spring-boot-starter-data-mongodb (1.5.19.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.18.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-fss-gridfs =3.0.5, =1.2.13.release,...

in.clouthink.daas:daas-fss-gridfs (>=3.0.5, <=3.0.7), org.springframework.boot:spring-boot-starter-data-mongodb (1.5.19.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.18.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-fss-gridfs =3.0.5, =1.2.13.release,...

This Week in Spring - October 31st, 2023

Hi Spring fans, and Happy Halloween from the Spring team to those who celebrate! I hope your evening is fun and your day free of scary bugs! My friends, we've got some interesting stuff to look at this week so let's dive right into it. A Bootiful Podcast: Mr. Spring in Action, Craig Walls Spring...