CVE-2025-53606 Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: 2.4.0. Users are recommended to upgrade to version 2.5.0, which fixes the issue...

CVE-2025-53606

Apache Seata (incubating) version 2.4.0 is vulnerable to a Deserialization of Untrusted Data vulnerability (CWE-502) in the org.apache.seata:seata-serializer-fury component. The root cause is the insecure handling of untrusted input data via the FurySerializerFactory class, which manages serializ...

CVE-2025-53606

creationtimestamp| type| source ---|---|--- 2025-08-07 15:35:12+00:00| seen| https://seclists.org/oss-sec/2025/q3/78 2025-08-07 18:59:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lvtgbk2tm427 2025-08-08 10:31:44+00:00| seen|...