cve-2026-41862

{
  "advisories": [
    {
      "id": "GHSA-85qj-f5wg-rwp9",
      "source": "ghsa",
      "title": "Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist",
      "url": "https://github.com/advisories/GHSA-85qj-f5wg-rwp9"
    }
  ],
  "cve": "CVE-2026-41862",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "[4.0.0,4.0.1.1)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[3.2.0,3.2.5)"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "cna",
          "scores": [
            {
              "score": 100.0,
              "source": "cna"
            }
          ]
        },
        "original": {
          "product": "Spring Statemachine",
          "source": "cna",
          "vendor": "Spring"
        },
        "product": "spring_statemachine",
        "vendor": "spring"
      }
    ],
    "created": "2026-06-23T23:45:04.625590+00:00",
    "updated": "2026-06-24T16:05:29.734273+00:00",
    "vendors": [
      "spring",
      "spring$PRODUCT$spring_statemachine"
    ]
  },
  "epss": {
    "score": 0.00762
  },
  "mitre": {
    "cpes": [],
    "created": "2026-06-23T20:59:02.378000+00:00",
    "description": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/41xxx/CVE-2026-41862.json",
    "references": [
      "https://spring.io/security/cve-2026-41862"
    ],
    "title": null,
    "updated": "2026-06-24T15:24:46.354000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-502"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-06-23T21:16:57.820000+00:00",
    "description": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-41862.json",
    "references": [
      "https://spring.io/security/cve-2026-41862"
    ],
    "title": null,
    "updated": "2026-09-22T15:23:28.377000+00:00",
    "vendors": [
      "broadcom",
      "broadcom$PRODUCT$spring_statemachine"
    ],
    "weaknesses": [
      "CWE-502"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-06-23T21:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "added": [
                "CWE-502"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://spring.io/security/cve-2026-41862"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "8c0b9e2d-6110-4c80-a434-9ca0eefda085"
      },
      {
        "created": "2026-06-24T00:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unrestricted Deserialization in Spring Statemachine Persistence Backends",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "48affa27-de6e-4805-921d-e5cc10886ec4"
      },
      {
        "created": "2026-06-24T03:45:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Unrestricted Deserialization in Spring Statemachine Persistence Backends"
            },
            "type": "title"
          }
        ],
        "id": "f5f5ad84-30e7-46ff-b404-79cc36111acf"
      },
      {
        "created": "2026-06-24T07:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Deserialization Without Class Allowlist in Spring Statemachine Enables Remote Code Execution",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "0402beb9-e22d-468a-b2a6-a3a128f5f86d"
      },
      {
        "created": "2026-06-24T09:45:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Deserialization Without Class Allowlist in Spring Statemachine Enables Remote Code Execution"
            },
            "type": "title"
          }
        ],
        "id": "571bfc80-ed3c-4494-b7b9-a691b81369a8"
      },
      {
        "created": "2026-06-24T16:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "9d23e049-e66b-4f07-bb4b-8ec6c5f3042e"
      },
      {
        "created": "2026-06-24T16:45:00+00:00",
        "data": [
          {
            "details": [
              "spring",
              "spring$PRODUCT$spring_statemachine"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "spring",
                "spring$PRODUCT$spring_statemachine"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "d6ef0260-f659-4fd9-923c-fc6708df8a9b"
      },
      {
        "created": "2026-09-22T15:30:00+00:00",
        "data": [
          {
            "details": [
              "broadcom",
              "broadcom$PRODUCT$spring_statemachine"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "broadcom",
                "broadcom$PRODUCT$spring_statemachine"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "31e85b44-9052-496a-a8c7-c18baeb72959"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2026-06-23T20:59:02.378000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00762
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://spring.io/security/cve-2026-41862"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2026-09-22T15:23:28.377000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "broadcom",
        "broadcom$PRODUCT$spring_statemachine",
        "spring",
        "spring$PRODUCT$spring_statemachine"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-502"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-06-23T20:59:02.378000+00:00",
    "description": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-06-24T15:24:30.233000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/41xxx/CVE-2026-41862.json",
    "weaknesses": []
  }
}