CVE-2025-53606: Apache Seata Serializer Fury Deserialization of Untrusted Data Vulnerability
Summary
CVE-2025-53606: Apache Seata: Deserialization of untrusted Data in Apache Seata Server. Affects org.apache.seata:seata-serializer-fury versions >= 2.4.0, < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Seata is an open-source distributed transaction solution designed for microservices. It provides a reliable and efficient way to manage transactions across multiple services. The 'seata-serializer-fury' package is a component of Seata that handles serialization tasks. However, versions prior to 2.5.0 are vulnerable to a deserialization issue that can lead to security risks.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data in Apache Seata, specifically in version 2.4.0. This flaw can allow an attacker to exploit the deserialization process, potentially leading to remote code execution or other malicious activities. The issue is categorized under CWE-502, which pertains to deserialization of untrusted data, posing a high severity risk to users of the affected version.
How To Fix
Latest published version: 2.5.0 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize data before deserialization. This can help mitigate the risks associated with untrusted data.
Conclusion
In summary, CVE-2025-53606 is a significant vulnerability in Apache Seata that requires immediate attention. Users should upgrade to version 2.5.0 or later to ensure their systems are secure. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for org.apache.seata:seata-serializer-fury →
FAQ
CVE-2025-53606 is a vulnerability in Apache Seata that allows for the deserialization of untrusted data, potentially leading to security breaches.
The vulnerability affects Apache Seata version 2.4.0. Users are advised to upgrade to version 2.5.0 or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml, Vulert can help you identify if your application is affected by this vulnerability.
Failing to address this vulnerability can expose your application to potential attacks, including remote code execution, which can compromise your system's integrity and security.
Yes, implementing input validation to sanitize data before deserialization can help reduce the risks associated with this vulnerability.
