EUVD-2026-38596
GHSA-85qj-f5wg-rwp9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable persistence backend (AV:N), low complexity once write access exists (AC:L), requires write privilege to the store (PR:L), no user interaction, full RCE impact on JVM.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.
Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4
Articles & Coverage 1
AnalysisAI
Remote code execution in Spring Statemachine 3.2.0-3.2.4 and 4.0.0-4.0.1 allows authenticated attackers to execute arbitrary code inside the application JVM by injecting malicious serialized Java objects into the Kryo-based persistence backends (JPA, MongoDB, Redis, or ZooKeeper). The flaw stems from deserializing persisted state-machine contexts without enforcing a class allowlist, a classic CWE-502 pattern that has historically yielded reliable gadget-chain exploitation in Java applications. No public exploit identified at time of analysis, but the deserialization sink and Kryo gadget ecosystem make weaponization straightforward once an attacker can write to the persistence store.
Technical ContextAI
Spring Statemachine is a Spring Framework library used to build hierarchical and distributed state machines in Java applications, with optional persistence so a state-machine's runtime context can survive restarts or be shared across cluster nodes. The library supports four persistence backends - JPA (relational databases), MongoDB, Redis, and Apache ZooKeeper - each backed by the Kryo serialization framework to marshal the StateMachineContext object. CWE-502 (Deserialization of Untrusted Data) applies because Kryo deserializers are invoked on persisted blobs without registering an allowlist of permitted classes; when Kryo is configured in its default 'auto-instantiate any class' mode, an attacker who can write into the backing store can supply a payload that constructs gadget chains (similar to ysoserial chains for Java) leading to RCE in the JVM hosting the state machine.
RemediationAI
Patch status: patch available per vendor advisory at https://spring.io/security/cve-2026-41862 - consult the advisory for the exact fixed releases in the 3.2.x and 4.0.x lines and upgrade Spring Statemachine accordingly. As a compensating control until patching, configure a strict Kryo class allowlist (Kryo.setRegistrationRequired(true) plus explicit kryo.register(...) calls for every legitimate StateMachineContext type) so unknown classes fail to deserialize; this is the most surgical mitigation but requires enumerating every persisted type. Alternatively, switch the persistence layer to a non-Kryo serializer (e.g., a JSON-based StateMachineSerialisationService), accepting a migration cost for existing persisted contexts. As a deployment-level mitigation, restrict write access on the JPA/Mongo/Redis/ZooKeeper instance to only the application identity and audit for any unexpected writers, recognizing this does not protect against compromise of that identity.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today