Spring Statemachine’s Kryo‑based persistence backends (JPA, MongoDB, Redis, ZooKeeper) deserialize persisted state‑machine contexts without enforcing a class allowlist. This flaw, identified as CWE‑502, allows an attacker to supply a crafted serialized payload that is executed within the application JVM, leading to remote code execution. The vulnerability is a classic case of deserialisation of untrusted data.

The affected product is Spring Statemachine provided by the Spring framework. Versions 4.0.0 through 4.0.1 and 3.2.0 through 3.2.4 are vulnerable.

The CVSS score of 8.8 indicates a high‑severity flaw. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a class allowlist provides a clear attack surface. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits as of now. However, the likely attack vector involves an adversary inserting malicious serialized data into one of the supported persistence backends; if this data is later deserialized by the application, arbitrary code will run with the JVM’s privileges.