CVE-2011-2894 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data
Remote attackers can execute arbitrary code by sending malicious serialized objects to applications using vulnerable Spring Framework or Spring Security versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-2894?
CVE-2011-2894 is a medium-severity unsafe deserialization vulnerability in Vmware Spring Framework, published on 4 Oct 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Weakness: CWE-502
Which versions are affected by CVE-2011-2894?
6 open source packages ship an affected version, including org.springframework.security:spring-security-core and org.springframework:spring-core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | From 2.0.0 | 2.0.7 |
org.springframework.security:spring-security-core Maven | From 2.0.0 | 2.0.7 |
org.springframework.security:spring-security-core Maven | From 3.0.0 | 3.0.6 |
org.springframework.security:spring-security-core Maven | From 3.0.0 | 3.0.6 |
org.springframework:spring-core Maven | From 3.0.0 | 3.0.6 |
org.springframework:spring-core Maven | From 3.0.0 | 3.0.6 |
Products include Vmware Spring Framework, Vmware Spring Security.
How do I fix CVE-2011-2894?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 2.0.7 or 3.0.6.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2011-2894 being exploited?
There is no known exploitation of CVE-2011-2894 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Vmware Spring Framework
- CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView
- CVE-2026-47890 Spring Framework Server Sent Event stream corruption while rendering fragments
- CVE-2026-47891 Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- CVE-2026-47892 Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
- CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework
Sources
Also known as GHSA-f866-m9mv-2xr3.