PT-2025-27321 · Apache · Apache Seata

Min Ji · Published 2025-06-28 · Updated 2026-03-28 · CVE-2025-32897

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Seata (incubating) versions 2.0.0 through 2.3.0

Description: The issue is related to the deserialization of untrusted data. It is recommended that users upgrade to a fixed version to resolve the issue.

Recommendations: For Apache Seata (incubating) versions 2.0.0 through 2.3.0, upgrade to version 2.3.0 to fix the issue.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-09489

CVE-2025-32897

GHSA-M964-FJRH-XXQ2

Affected Products

Apache Seata

References · 17

• https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950 · Patch
• https://osv.dev/vulnerability/CVE-2025-32897 · Vendor Advisory
• https://lists.apache.org/thread/9fhtf7yvpjpzlwd1m0wfgg6tp2btxpy1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47552 · Security Note
• https://osv.dev/vulnerability/GHSA-m964-fjrh-xxq2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32897 · Security Note
• https://bdu.fstec.ru/vul/2025-09489 · Security Note
• https://github.com/apache/incubator-seata · Note
• https://github.com/apache/incubator-seata/commit/7eda23e948312ed52c3336de70a11f4d2ab06a48 · Note
• https://twitter.com/VulmonFeeds/status/1939055482750075196 · Twitter Post
• https://twitter.com/CVEnew/status/1939033136773423119 · Twitter Post
• https://twitter.com/pulsepatchio/status/2037902744812400838 · Twitter Post
• https://t.me/cvenotify/126989 · Telegram Post
• https://t.me/cvetracker/27322 · Telegram Post
• https://twitter.com/cracbot/status/1940727276062310456 · Twitter Post