PT-2025-27331 · Akka · Akka

Published 2025-06-28 · Updated 2025-06-29 · CVE-2025-53393

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Akka versions through 2.10.6

Description: The issue concerns the use of Java serialization for cluster metrics in the akka-cluster-metrics component.

Recommendations: For versions through 2.10.6, consider disabling Java serialization for cluster metrics as a temporary workaround until a patch is available. Restrict access to the akka-cluster-metrics component to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-00090

CVE-2025-53393

GHSA-358M-FQ53-HP87

Affected Products

Akka

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-53393 · Security Note
• https://osv.dev/vulnerability/GHSA-358m-fq53-hp87 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00090 · Security Note
• https://github.com/akka/akka/pull/32748 · Note
• https://github.com/akka/akka · Note
• https://github.com/akka/akka/commit/d69a082abfa26ccc076f090a6486ccfee9d7c481 · Note
• https://twitter.com/transilienceai/status/1939167140247920864 · Twitter Post
• https://t.me/cvetracker/27331 · Telegram Post
• https://twitter.com/transilienceai/status/1939167133277081704 · Twitter Post
• https://twitter.com/CVEnew/status/1939100270023360997 · Twitter Post