High severity8.8NVD Advisory· Published Jun 23, 2026· Updated Jun 25, 2026
CVE-2026-41862
CVE-2026-41862
Description
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.
Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 4.0.0 - 4.0.1, 3.2.0 - 3.2.4
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.