CVE-2026-41862: High severity Spring Spring Statemachine vulnerability
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.
Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41862?
The severity of CVE-2026-41862 is high, with a CVSS score of 8.8.
What risks does CVE-2026-41862 pose?
CVE-2026-41862 can lead to remote code execution inside the application JVM due to deserialization of untrusted data.
How do I fix CVE-2026-41862?
To fix CVE-2026-41862, ensure that you are using a version of Spring Statemachine that implements a class allowlist for deserialization.
Which versions of Spring Statemachine are affected by CVE-2026-41862?
CVE-2026-41862 affects versions of Spring Statemachine that utilize Kryo-based persistence backends without an enforced class allowlist.
What is the impact of CVE-2026-41862 on my application?
The impact of CVE-2026-41862 on your application includes potential remote code execution and compromise of the application's security.