AIKIDO-2026-448372
spring-statemachine-kryo is vulnerable to Unsafe Deserialization
80
High Risk
This Affects:
spring-statemachine-kryoTL;DR
Spring Statemachine contains an unsafe deserialization vulnerability in its Kryo-based persistence backends. Persisted state machine contexts are deserialized without enforcing a class allowlist, allowing attackers who can influence persisted data to trigger the deserialization of malicious objects. Successful exploitation may result in remote code execution within the application JVM.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-statemachine-kryo is vulnerable to Unsafe Deserialization in versions 3.2.0 - 3.2.4 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the org.springframework.statemachine:spring-statemachine-kryo library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant