CVE-2025-53393: akka-cluster-metrics uses Java serialization for cluster metrics

June 29, 2025 (updated June 30, 2025)

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.

References

github.com/advisories/GHSA-358m-fq53-hp87
github.com/akka/akka
github.com/akka/akka/commit/d69a082abfa26ccc076f090a6486ccfee9d7c481
github.com/akka/akka/pull/32748
nvd.nist.gov/vuln/detail/CVE-2025-53393

Code Behaviors & Features

Detect and mitigate CVE-2025-53393 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →