Spring Statemachine vulnerabilities

1 known vulnerability in Spring Statemachine from Spring. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Spring Statemachine: Deserialization of Untrusted Data

  CVE-2026-41862Jun 23, 2026Spring

  Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution ins