Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Priority MEDIUM 49CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Why it matters now
EPSS 0.04409 91st percentileScored 2026-11-07
Fix Fixed Spring Integration (Spring by VMware): v4.3.23.RELEASE, v5.1.12.RELEASE, v5.2.8.RELEASE +1org.springframework.integration:spring-integration-core (Maven): 4.3.23, 5.3.2, 5.1.12 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Integration | 4.3 to before v4.3.23.RELEASE; 5.1 to before v5.1.12.RELEASE; 5.2 to before v5.2.8.RELEASE; 5.3 to before v5.3.2.RELEASE | v4.3.23.RELEASE, v5.1.12.RELEASE, v5.2.8.RELEASE, v5.3.2.RELEASE | Patch available | CNA |
| — | org.springframework.integration:spring-integration-core (Maven) | 4.3.0 to before 4.3.23 | 4.3.23 | Patch available | GHSA-86qr-9vqc-pgc6 |
| — | org.springframework.integration:spring-integration-core (Maven) | 5.3.0 to before 5.3.2 | 5.3.2 | Patch available | GHSA-86qr-9vqc-pgc6 |
| — | org.springframework.integration:spring-integration-core (Maven) | 5.1.0 to before 5.1.12 | 5.1.12 | Patch available | GHSA-86qr-9vqc-pgc6 |
| — | org.springframework.integration:spring-integration-core (Maven) | 5.2.0 to before 5.2.8 | 5.2.8 | Patch available | GHSA-86qr-9vqc-pgc6 |
- Spring Integration VendorVMware Affected 4.3 to before v4.3.23.RELEASE; 5.1 to before v5.1.12.RELEASE; 5.2 to before v5.2.8.RELEASE; 5.3 to before v5.3.2.RELEASE Fixed in v4.3.23.RELEASE, v5.1.12.RELEASE, v5.2.8.RELEASE, v5.3.2.RELEASE Patch available CNA
- org.springframework.integration:spring-integration-core (Maven) Vendor— Affected 4.3.0 to before 4.3.23 Fixed in 4.3.23 Patch available GHSA-86qr-9vqc-pgc6
- org.springframework.integration:spring-integration-core (Maven) Vendor— Affected 5.3.0 to before 5.3.2 Fixed in 5.3.2 Patch available GHSA-86qr-9vqc-pgc6
- org.springframework.integration:spring-integration-core (Maven) Vendor— Affected 5.1.0 to before 5.1.12 Fixed in 5.1.12 Patch available GHSA-86qr-9vqc-pgc6
- org.springframework.integration:spring-integration-core (Maven) Vendor— Affected 5.2.0 to before 5.2.8 Fixed in 5.2.8 Patch available GHSA-86qr-9vqc-pgc6
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:* | 4.3.0 – 4.3.22; 5.1.0 – 5.1.11; 5.2.0 – 5.2.7; 5.3.0 – 5.3.1 | Vulnerable | VMware |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
- cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:* Versions 4.3.0 – 4.3.22; 5.1.0 – 5.1.11; 5.2.0 – 5.2.7; 5.3.0 – 5.3.1 Vulnerable ·VMware
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* | 16.0 – 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* | 16.0.3 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:* Versions 16.0 – 19.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
Remediation
- Fix · CNA Spring Integration (Spring by VMware) Fixed in v4.3.23.RELEASE, v5.1.12.RELEASE, v5.2.8.RELEASE, v5.3.2.RELEASE
- Fix · GHSA-86qr-9vqc-pgc6 org.springframework.integration:spring-integration-core (Maven) Fixed in 4.3.23 Advisory →
- Fix · GHSA-86qr-9vqc-pgc6 org.springframework.integration:spring-integration-core (Maven) Fixed in 5.3.2 Advisory →
- Fix · GHSA-86qr-9vqc-pgc6 org.springframework.integration:spring-integration-core (Maven) Fixed in 5.1.12 Advisory →
- Fix · GHSA-86qr-9vqc-pgc6 org.springframework.integration:spring-integration-core (Maven) Fixed in 5.2.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5413
- 2026-10-03 Alias added: GHSA-86qr-9vqc-pgc6
References
Patch 4
Advisory 2
More VMware Spring Integration vulnerabilities
- TI-2026-35313 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution CVSS 3.1CRITICAL 9.8
- TI-2019-02786 Spring Integration XML External Entity Injection (XXE) CVSS 3.0CRITICAL 9.8
- TI-2026-42455 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction CVSS 3.1HIGH 8.2
- TI-2026-42439 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference CVSS 3.1HIGH 8.0
- TI-2026-42425 SMB minimum protocol dialect defaults to SMB1 CVSS 3.1MEDIUM 6.6
- TI-2026-29638 Path traversal in VMware Spring Integration CVSS 3.1HIGH 7.1
Sources
- CVE-2020-5413 · CVE Program
- CVE-2020-5413 · NVD
- FIRST EPSS
- GHSA-86qr-9vqc-pgc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences