TI-2026-30272 Aliases CVE-2026-41862 GHSA-85qj-f5wg-rwp9

Deserialization of untrusted data in VMware Spring Statemachine

MEDIUM 41CWE-502Published 2026-06-23 · Updated 2026-06-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00762 55th percentileScored 2026-11-07

Fix Fixed Spring Statemachine (Spring): 4.0.1.1, 3.2.5org.springframework.statemachine:spring-statemachine-kryo (Maven): 4.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Statemachine	4.0.0 to before 4.0.1.1; 3.2.0 to before 3.2.5	4.0.1.1, 3.2.5	Patch available	CNA
—	org.springframework.statemachine:spring-statemachine-kryo (Maven)	3.2.0 – 3.2.4	—	No fix listed	GHSA-85qj-f5wg-rwp9
—	org.springframework.statemachine:spring-statemachine-kryo (Maven)	4.0.0 to before 4.0.2	4.0.2	Patch available	GHSA-85qj-f5wg-rwp9

Spring Statemachine VendorVMware Affected 4.0.0 to before 4.0.1.1; 3.2.0 to before 3.2.5 Fixed in 4.0.1.1, 3.2.5 Patch available CNA
org.springframework.statemachine:spring-statemachine-kryo (Maven) Vendor— Affected 3.2.0 – 3.2.4 Fixed in — No fix listed GHSA-85qj-f5wg-rwp9
org.springframework.statemachine:spring-statemachine-kryo (Maven) Vendor— Affected 4.0.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-85qj-f5wg-rwp9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:broadcom:spring_statemachine::::::::	3.2.0 to before 3.2.5; 4.0.0 to before 4.0.2	Vulnerable	Broadcom

cpe:2.3:a:broadcom:spring_statemachine:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.5; 4.0.0 to before 4.0.2 Vulnerable ·Broadcom

Remediation

Fix · CNA Spring Statemachine (Spring) Fixed in 4.0.1.1, 3.2.5
Fix · GHSA-85qj-f5wg-rwp9 org.springframework.statemachine:spring-statemachine-kryo (Maven) Fixed in 4.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41862
2026-10-03 Alias added: GHSA-85qj-f5wg-rwp9

References

Advisory 2

Other 3

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences