Spring Spring Statemachine vulnerabilities (CVE)

CVE records published for Spring Spring Statemachine, newest first. Follow to get an email when a new one appears.

1 results

8.8High

CVE-2026-41862 4 months ago

Spring Spring Statemachine

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution in…