CVE-2025-32897: Apache Seata Vulnerable to Deserialization of Untrusted Data

June 28, 2025 (updated June 30, 2025)

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).

This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0.

Users are recommended to upgrade to version 2.3.0, which fixes the issue.

References

github.com/advisories/GHSA-m964-fjrh-xxq2
github.com/apache/incubator-seata
github.com/apache/incubator-seata/commit/7eda23e948312ed52c3336de70a11f4d2ab06a48
lists.apache.org/thread/9fhtf7yvpjpzlwd1m0wfgg6tp2btxpy1
nvd.nist.gov/vuln/detail/CVE-2025-32897
www.cve.org/CVERecord?id=CVE-2024-47552

Code Behaviors & Features

Detect and mitigate CVE-2025-32897 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →