Executive brief
Spring Statemachine is a framework used by developers to manage complex application states in Java environments. A security flaw in how it saves and restores data using certain databases (JPA, MongoDB, Redis, and ZooKeeper) allows an attacker to execute malicious code on the server. This could lead to a full system takeover, data theft, or disruption of business operations.
Technical details
A deserialization vulnerability (CWE-502) exists in Spring Statemachine when using Kryo-based persistence backends including JPA, MongoDB, Redis, and ZooKeeper. The root cause is the failure to enforce a class allowlist during the deserialization of persisted state-machine contexts. An attacker with the ability to influence or modify the persisted state data can trigger the execution of arbitrary code within the context of the application's JVM. The vulnerability is reachable over the network if the persistence store is accessible or if the application processes untrusted state data. Patches are available in versions 4.0.1.1 and 3.2.5.
Affected products
- Spring Spring Statemachine 4.0.0 through 4.0.1, 3.2.0 through 3.2.4
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory