CVE-2026-41862 Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist
Attackers can achieve remote code execution by exploiting unsafe Kryo deserialization in Spring Statemachine persistence backends.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41862?
CVE-2026-41862 is a high-severity unsafe deserialization vulnerability in Spring Statemachine, published on 23 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.
Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4
Weakness: CWE-502
Which versions are affected by CVE-2026-41862?
4 open source packages ship an affected version, including org.springframework.statemachine:spring-statemachine-kryo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.statemachine:spring-statemachine-kryo Maven | From 3.2.0 to 3.2.4 | None |
org.springframework.statemachine:spring-statemachine-kryo Maven | From 3.2.0 to 3.2.4 | None |
org.springframework.statemachine:spring-statemachine-kryo Maven | From 4.0.0 | 4.0.2 |
org.springframework.statemachine:spring-statemachine-kryo Maven | From 4.0.0 | 4.0.2 |
Products include Broadcom Spring Statemachine.
How do I fix CVE-2026-41862?
Upgrade org.springframework.statemachine:spring-statemachine-kryo to 4.0.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-41862 being exploited?
There is no known exploitation of CVE-2026-41862 in the wild and no public exploit code.
Sources
Also known as GHSA-85qj-f5wg-rwp9.