org.apache.seata/seata-server vulnerabilities

Latest org.apache.seata/seata-server CVEs

Newest publication first

1. CVE-2025-32897 Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server

   Published 2025-06-28

   Critical·CVSS 9.8 EPSS 2.0%

   Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating): from 2.0.0 before...

2. CVE-2024-47552 Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server

   Published 2025-03-20

   Critical·CVSS 9.8 EPSS 1.2%

   Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-w...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.