All vulnerabilities
CVE-2026-41862GHSA-85qj-f5wg-rwp9

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

Spring org.springframework.statemachine:spring-statemachine-kryomavenFrameworks
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.76%Chance of exploitation activity in the next 30 days, higher than 54% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.0.2Also 4.0.1.1, 3.2.5GitHub
Published23 Jun 2026Updated 24 Sep 2026CVE List

What fixes it

  • 4.0.2org.springframework.statemachine:spring-statemachine-kryo, mavenGitHub<dependency><groupId>org.springframework.statemachine</groupId><artifactId>spring-statemachine-kryo</artifactId><version>4.0.2</version></dependency>
  • 4.0.1.1Spring StatemachineCVE List
  • 3.2.5Spring StatemachineCVE List
  • 4.0.2org.springframework.statemachine:spring-statemachine-kryo, MavenOSV<dependency><groupId>org.springframework.statemachine</groupId><artifactId>spring-statemachine-kryo</artifactId><version>4.0.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.

Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

Text from GitHub Advisory Database

Affected versions 10

  • org.springframework.statemachine:spring-statemachine-kryo, maven>= 3.2.0, <= 3.2.4GitHub
  • org.springframework.statemachine:spring-statemachine-kryo, maven>= 4.0.0, <= 4.0.1GitHub
  • Spring Statemachineaffected: 4.0.0 before 4.0.1.1CVE List
  • Spring Statemachineaffected: 3.2.0 before 3.2.5CVE List
  • org.springframework.statemachine:spring-statemachine-kryo, Mavenfrom 3.2.0, through 3.2.4OSV
  • org.springframework.statemachine:spring-statemachine-kryo, Maven3.2.0OSV
  • org.springframework.statemachine:spring-statemachine-kryo, Maven3.2.1OSV
  • org.springframework.statemachine:spring-statemachine-kryo, Mavenfrom 4.0.0, fixed in 4.0.2OSV
  • org.springframework.statemachine:spring-statemachine-kryo, Maven4.0.0OSV
  • org.springframework.statemachine:spring-statemachine-kryo, Maven4.0.1OSV

References 5