Security Advisory

CVE-2026-41862

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-23 20:59:02

Last updated 2026-06-24 15:24:46

Assigner vmware

CVSS score 8.8

State PUBLISHED

Description

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

← Browse all CVEs View on cve.org ↗