{"id":"CVE-2026-41862","aliases":["GHSA-85qj-f5wg-rwp9"],"url":"https://o3.security/vulnerability/CVE-2026-41862","summary":"Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist","details":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","published":"2026-06-23T20:59:02.378Z","modified":"2026-10-24T10:30:26.411002053Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00423,"percentile":0.35616,"asOf":"2026-08-21"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.springframework.statemachine:spring-statemachine-kryo","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework.statemachine:spring-statemachine-kryo","fixedVersion":"4.0.2"}],"fix":{"url":"https://github.com/spring-attic/spring-statemachine/commit/6b77ea6b729e5346d83e31f36c43818665d67384","label":"spring-attic/spring-statemachine@6b77ea6"},"references":[{"type":"WEB","url":"https://spring.io/security/cve-2026-41862"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41862.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41862"},{"type":"WEB","url":"https://github.com/spring-attic/spring-statemachine/commit/6b77ea6b729e5346d83e31f36c43818665d67384"},{"type":"PACKAGE","url":"https://github.com/spring-attic/spring-statemachine"},{"type":"WEB","url":"https://github.com/spring-attic/spring-statemachine/releases/tag/v4.0.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:26.411002053Z"}}