Product

org.springframework.statemachine/spring-statemachine-kryo vulnerabilities

1 published CVE affecting org.springframework.statemachine/spring-statemachine-kryo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 1
Medium: 0
Low: 0
Unscored: 0
CISA KEV: 0

Latest org.springframework.statemachine/spring-statemachine-kryo CVEs

Newest publication first

CVE-2026-41862 Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Published 2026-06-23

HighCVSS 8.8 EPSS 0.76%

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

org.springframework.statemachine/spring-statemachine-kryo vulnerabilities

Latest org.springframework.statemachine/spring-statemachine-kryo CVEs

CVE-2026-41862 Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist