CVE-2024-47552

The Apache Seata (incubating) microservice framework (versions 2.0.0 to before 2.2.0 ) is vulnerable to a deserialization of untrusted data flaw. This vulnerability is specifically isolated to the Raft cluster mode (jraft mode), which is an optional and non-default feature. If exploited, a malici...

CVE-2024-22399

CVE-2024-22399 describes a deserialization of untrusted data vulnerability in Apache Seata Server that can enable remote code execution when attackers exploit the Seata private protocol via serialized payloads. Affected are Seata versions ranging from 1.0.0 through 1.8.0 and 2.0.0, with exploitat...

CVE-2025-32897

Apache Seata (incubating) versions 2.0.0 before 2.3.0 are vulnerable to a deserialization of untrusted data flaw. The root cause is the unsafe deserialization of serialized data received from a user, which could allow an attacker to achieve code execution or trigger service failures . This vulner...

CVE-2024-54016

Apache Seata (incubating) is vulnerable to an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability, specifically within the ZstdUtil component. This flaw allows an attacker to cause service failures or performance degradation by sending very large compressed data. The vu...

CVE-2025-53606

Apache Seata (incubating) version 2.4.0 is vulnerable to a Deserialization of Untrusted Data vulnerability (CWE-502) in the org.apache.seata:seata-serializer-fury component. The root cause is the insecure handling of untrusted input data via the FurySerializerFactory class, which manages serializ...