CVE Intelligence

Spring Spring Statemachine vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Spring Spring Statemachine: 1 record(s), with affected versions and fixes.

CVE-2026-41862 High · 8.8 CWE-502 Jun 23, 2026
Deserialization of Untrusted Data in Broadcom Spring Statemachine
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4