Seata vulnerabilities

4 known vulnerabilities in Seata from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Apache Seata (incubating): Deserialization of Untrusted Data

  CVE-2025-53606Aug 8, 2025Apache

  Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to upgrade to version 2.5.0, which fixes the issue.

• 9.8 Critical severity

  Apache Seata (incubating): Deserialization of Untrusted Data

  CVE-2025-32897Jun 28, 2025ApacheEPSS 2.04%

  Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating

• 9.8 Critical severity

  Apache Seata (incubating): Deserialization of Untrusted Data

  CVE-2024-47552Mar 20, 2025ApacheEPSS 1.25%

  Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due

• 9.8 Critical severity

  Apache Seata: Deserialization of Untrusted Data

  CVE-2024-22399Sep 16, 2024ApacheEPSS 3.29%

  Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending byte