Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-53606 EUVD-2025-23981GHSA-g358-g2pq-c46j

Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server

Published Aug 8, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Seata (incubating) Package: org.apache.seata:seata-serializer-fury Ecosystem: Maven

Description

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).

This issue affects Apache Seata (incubating): 2.4.0.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Seata (incubating) 2.4.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.seata:seata-serializer-fury >= 2.4.0, < 2.5.0 2.5.0 GHSA-g358-g2pq-c46j

References