{"advisories":[{"id":"GHSA-85qj-f5wg-rwp9","source":"ghsa","title":"Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist","url":"https://github.com/advisories/GHSA-85qj-f5wg-rwp9"}],"cve":"CVE-2026-41862","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[4.0.0,4.0.1.1)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.2.0,3.2.5)"}}],"enrichment":{"confidence":100.0,"confidence_source":"cna","scores":[{"score":100.0,"source":"cna"}]},"original":{"product":"Spring Statemachine","source":"cna","vendor":"Spring"},"product":"spring_statemachine","vendor":"spring"}],"created":"2026-06-23T23:45:04.625590+00:00","updated":"2026-06-24T16:05:29.734273+00:00","vendors":["spring","spring$PRODUCT$spring_statemachine"]},"epss":{"score":0.00762},"mitre":{"cpes":[],"created":"2026-06-23T20:59:02.378000+00:00","description":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/41xxx/CVE-2026-41862.json","references":["https://spring.io/security/cve-2026-41862"],"title":null,"updated":"2026-06-24T15:24:46.354000+00:00","vendors":[],"weaknesses":["CWE-502"]},"nvd":{"cpes":["cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"],"created":"2026-06-23T21:16:57.820000+00:00","description":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-41862.json","references":["https://spring.io/security/cve-2026-41862"],"title":null,"updated":"2026-09-22T15:23:28.377000+00:00","vendors":["broadcom","broadcom$PRODUCT$spring_statemachine"],"weaknesses":["CWE-502"]},"opencve":{"changes":[{"created":"2026-06-23T21:15:00+00:00","data":[{"details":{"new":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","old":null},"type":"description"},{"details":{"added":["CWE-502"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://spring.io/security/cve-2026-41862"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"8c0b9e2d-6110-4c80-a434-9ca0eefda085"},{"created":"2026-06-24T00:00:00+00:00","data":[{"details":{"new":"Unrestricted Deserialization in Spring Statemachine Persistence Backends","old":null},"type":"title"}],"id":"48affa27-de6e-4805-921d-e5cc10886ec4"},{"created":"2026-06-24T03:45:00+00:00","data":[{"details":{"new":null,"old":"Unrestricted Deserialization in Spring Statemachine Persistence Backends"},"type":"title"}],"id":"f5f5ad84-30e7-46ff-b404-79cc36111acf"},{"created":"2026-06-24T07:00:00+00:00","data":[{"details":{"new":"Deserialization Without Class Allowlist in Spring Statemachine Enables Remote Code Execution","old":null},"type":"title"}],"id":"0402beb9-e22d-468a-b2a6-a3a128f5f86d"},{"created":"2026-06-24T09:45:00+00:00","data":[{"details":{"new":null,"old":"Deserialization Without Class Allowlist in Spring Statemachine Enables Remote Code Execution"},"type":"title"}],"id":"571bfc80-ed3c-4494-b7b9-a691b81369a8"},{"created":"2026-06-24T16:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"9d23e049-e66b-4f07-bb4b-8ec6c5f3042e"},{"created":"2026-06-24T16:45:00+00:00","data":[{"details":["spring","spring$PRODUCT$spring_statemachine"],"type":"first_time"},{"details":{"added":["spring","spring$PRODUCT$spring_statemachine"],"removed":[]},"type":"vendors"}],"id":"d6ef0260-f659-4fd9-923c-fc6708df8a9b"},{"created":"2026-09-22T15:30:00+00:00","data":[{"details":["broadcom","broadcom$PRODUCT$spring_statemachine"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["broadcom","broadcom$PRODUCT$spring_statemachine"],"removed":[]},"type":"vendors"}],"id":"31e85b44-9052-496a-a8c7-c18baeb72959"}],"cpes":{"data":["cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-23T20:59:02.378000+00:00","provider":"mitre"},"description":{"data":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00762},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://spring.io/security/cve-2026-41862"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2026-09-22T15:23:28.377000+00:00","provider":"nvd"},"vendors":{"data":["broadcom","broadcom$PRODUCT$spring_statemachine","spring","spring$PRODUCT$spring_statemachine"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-502"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-06-23T20:59:02.378000+00:00","description":"Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-06-24T15:24:30.233000+00:00","vendors":[],"vulnrichment_repo_path":"2026/41xxx/CVE-2026-41862.json","weaknesses":[]}}