Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

CVE-2026-41862 (GCVE-0-2026-41862)

Vulnerability from cvelistv5 – Published: 2026-06-23 20:59 – Updated: 2026-06-24 15:24

Summary

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

vmware

References

URL

Tags

https://spring.io/security/cve-2026-41862

Impacted products

	Vendor	Product	Version
	Spring	Spring Statemachine	Affected: 4.0.0 , < 4.0.1.1 (custom) Affected: 3.2.0 , < 3.2.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-24T15:24:25.858234Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-24T15:24:46.354Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Statemachine",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.1.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.5",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Spring Statemachine\u0027s Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4"
            }
          ],
          "value": "Spring Statemachine\u0027s Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.\n\nAffected versions:\nSpring Statemachine 4.0.0 through 4.0.1\nSpring Statemachine 3.2.0 through 3.2.4"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can write to a Kryo-backed state-machine persistence store can achieve remote code execution inside the application JVM with high impact on confidentiality, integrity, and availability."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T20:59:02.378Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41862"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41862",
    "datePublished": "2026-06-23T20:59:02.378Z",
    "dateReserved": "2026-04-22T06:22:10.082Z",
    "dateUpdated": "2026-06-24T15:24:46.354Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0739

Vulnerability from certfr_avis - Published: 2026-06-11 - Updated: 2026-06-11

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Spring Web Flow	Web Flow versions 4.0.x antérieures à 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)
Spring	Spring Statemachine	Statemachine versions 3.2.x antérieures à 3.2.5
Spring	Spring Boot	Boot versions 3.4.x antérieures à 3.4.17
Spring	Spring Web Flow	Web Flow versions 3.0.x antérieures à 3.0.2 (source ouverte) ou 3.0.1.1 (licence commerciale)
Spring	Spring Web Services	Web Services versions 5.0.x antérieures à 5.0.2 (source ouverte) ou 5.0.1.1 (licence commerciale)
Spring	Spring Integration	Integration versions 5.5.x antérieures à 5.5.21
Spring	Spring Integration	Integration versions 6.4.x antérieures à 6.4.12
Spring	Spring Web Services	Web Services versions 4.0.x antérieures à 4.0.19
Spring	Spring Boot	Boot versions 4.0.x antérieures à 4.0.7 (source ouverte) ou 4.0.6.1 (licence commerciale)
Spring	Spring Integration	Integration versions 6.3.x antérieures à 6.3.15
Spring	Spring Integration	Integration versions 6.5.x antérieures à 6.5.9 (source ouverte) ou 6.5.8.1 (licence commerciale)
Spring	Spring Boot	Boot versions 3.5.x antérieures à 3.5.15 (source ouverte) ou 3.5.14.1 (licence commerciale)
Spring	Spring Web Services	Web Services versions 4.1.x antérieures à 4.1.4 (source ouverte) ou 4.1.3.1 (licence commerciale)
Spring	Spring Web Services	Web Services versions 3.1.x antérieures à 3.1.9
Spring	Spring Statemachine	Statemachine versions 4.0.x antérieures à 4.0.2 (source ouverte) ou 4.0.1.1 (licence commerciale)
Spring	Spring Web Flow	Web Flow versions 2.5.x antérieures à 2.5.2
Spring	Spring Integration	Integration versions 7.0.x antérieures à 7.0.5 (source ouverte) ou 7.0.4.1 (licence commerciale)

References

Title

Publication Time