← CVE Intelligence

CVE-2026-41862

Spring / Spring Statemachine PUBLISHED

Description (CNA)

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

Affected (CNA)

Vendor / productVersions
Spring / Spring Statemachineaffected 4.0.0 before 4.0.1.1; affected 3.2.0 before 3.2.5

CWE

CWE-502

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.