CVE-2026-41862: Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

June 23, 2026 (updated September 24, 2026)

Spring Statemachine’s Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.

Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

References

github.com/advisories/GHSA-85qj-f5wg-rwp9
github.com/spring-attic/spring-statemachine/commit/6b77ea6b729e5346d83e31f36c43818665d67384
github.com/spring-attic/spring-statemachine/releases/tag/v4.0.2
nvd.nist.gov/vuln/detail/CVE-2026-41862
spring.io/security/cve-2026-41862

Code Behaviors & Features

Detect and mitigate CVE-2026-41862 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →