{"id":"CVE-2025-32897","summary":"Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server","details":"Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).\n\nThis security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow.\nThis issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0.\n\nSeverity Justification:\nThe Apache Seata security team assesses the severity of this vulnerability as \"Low\" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.\nUsers are recommended to upgrade to version 2.3.0, which fixes the issue.","aliases":["GHSA-m964-fjrh-xxq2"],"modified":"2026-08-12T15:16:28.436565Z","published":"2025-06-28T18:25:18.312Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32897.json"},"references":[{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2024-47552"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32897.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/9fhtf7yvpjpzlwd1m0wfgg6tp2btxpy1"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32897"},{"type":"FIX","url":"https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/incubator-seata","events":[{"introduced":"f43e2a9268992b161f38c4d6eccc77646cc39ff4"},{"fixed":"0ad2847465fa877a2c65ea84ed43f5b0984c3ce9"},{"fixed":"20cd9625d23f99b71fefc83b8db96c14092a9950"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:apache:seata:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32897.json","vanir_signatures_modified":"2026-08-12T15:16:28Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950","target":{"file":"server/src/main/java/org/apache/seata/server/cluster/raft/sync/RaftSyncMessageSerializer.java"},"deprecated":false,"digest":{"line_hashes":["323286864113777373415226563596757790492","68053270746768430121237132478664554562","89082348254726730640682655760983427162","277090383265004152848737974427985962237","284722311939520853825944104701855824623","154369699026410118971999512328632389285","322241984329442258543268850066195975533","243768917840693173359536346597522885154","183426278005462319393598730756135448288","336921518095587215163337384391362719609","270547872728093527376110473491205132109","139154714013904141467117147901252500675","5162858876994809127462219479655743569","277635304333359435984296808971015593027","171807971528683800378578942348658862119","338334204775032263405275790971137512411","120643101713023315241030341210644103909","187320433378524918115043065970724364943","60352907883279104904665055398201891444","314534388408142732506094877233296797049","232761663523923415470493213332473179105","132641775052265626170732918253779668126","323110183067989622168878992467341447192","216746744197983615855352151925346139039","298209406429866395322146132361678869698","188427033761733228278804598847284150791","64066286638810331604984302791283990075"],"threshold":0.9},"id":"CVE-2025-32897-062a7439","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"240067990988798984774333426527542216993","length":781},"id":"CVE-2025-32897-07302aff","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9","target":{"file":"compatible/src/test/java/io/seata/tm/api/DefaultFailureHandlerImplTest.java","function":"onRollbackFailure"}},{"digest":{"threshold":0.9,"line_hashes":["214371701131224498867116484830138557703","103326891935392308817415952443352830416","29836720890721288277864917060910770819","186845443821405445959121861006761966953","217365845043367773184233231979282871872","82114271901885231626273463470417740184","146361738576118732171276518781402474454","310510940811645211455589781085390188165","263244397258121676730293097289174157752","29439393588654488175608979012935492705","102413946797138234201662137666013873019","260497709188647182438199528598918129591","215173368832176471242132037284754458404","175215250857535432569302346962253013528","62986732600527447919352984799946447514","118997166559430201205377471925113345461","322471347800547440191851543434567799974","122680355191551761480435053745164815374","276339125260561915457282481194820802964","140547074940766806655608472131492699319","174350547264623027348106163151060642331","137923086386680235195368373485846998567","272888749388520485511006835967757413987","118997166559430201205377471925113345461","321094720905825230590926674286971477305","60588315817936963341787888240580836278","218198032645929880224463458707450260537","15319099719913058711416722187492345748","317550517784042902280322593981889560653","89368058117736478701828344361097650381","27308704412086359555145297805837498242","301319239267573754008104887185413256567","222450974535972369463885271580295867730","244121519962982378680254867060810488396","95632042134146977834463884110560855540","230550138545905725533269700658427621704","248614934668312562197066148392379201343","206041177008454488933624853012107108510","144720166662055302258879218510818532341","94660915357466434881163650744661959389","241873659775370499306438596218264438967","48056173169660791785897840437312774305","118997166559430201205377471925113345461","78501750082687453791018867956359540867","134980027055803332390119242149718454755","262683033407838943273187555829451481280","295546450488981567970016300238048336620","317550517784042902280322593981889560653","89368058117736478701828344361097650381","27308704412086359555145297805837498242","92631555481375945709892771140716687871","299377563284640409359971873919771245737","71071283592129147174369364284906572370","150819172612671075925115838154738652001","230550138545905725533269700658427621704","248614934668312562197066148392379201343","283055200384401393662846797855649751488"]},"id":"CVE-2025-32897-286a2cfe","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9","target":{"file":"compatible/src/test/java/io/seata/tm/api/DefaultFailureHandlerImplTest.java"},"deprecated":false},{"source":"https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950","target":{"file":"common/src/main/java/org/apache/seata/common/exception/ErrorCode.java"},"deprecated":false,"digest":{"line_hashes":["40221159007574213658017743905435654747","128052110860093768749414265174669140079","321357591775997841762275666271942041769","54100824190366698426876224285016891244","60232042426928859341002131608162196884","213903140803870946656496891195369916554","166363707460415669561305442435290832339"],"threshold":0.9},"id":"CVE-2025-32897-2a3145e4","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-32897-4bf21141","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9","target":{"file":"tm/src/test/java/org/apache/seata/tm/api/DefaultFailureHandlerImplTest.java","function":"onBeginFailure"},"deprecated":false,"digest":{"function_hash":"202134273638937640523091858698907516464","length":301}},{"target":{"file":"tm/src/test/java/org/apache/seata/tm/api/DefaultFailureHandlerImplTest.java","function":"onCommitFailure"},"deprecated":false,"digest":{"function_hash":"11443722429053205124381077063215277104","length":763},"id":"CVE-2025-32897-6de3dd52","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9"},{"signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950","target":{"file":"server/src/main/java/org/apache/seata/server/cluster/raft/sync/RaftSyncMessageSerializer.java","function":"decode"},"deprecated":false,"digest":{"function_hash":"50271195128808227487233020289284454656","length":960},"id":"CVE-2025-32897-6e965ff0","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9","target":{"function":"onRollbackFailure","file":"tm/src/test/java/org/apache/seata/tm/api/DefaultFailureHandlerImplTest.java"},"deprecated":false,"digest":{"function_hash":"40891575550624031541142231537032272934","length":764},"id":"CVE-2025-32897-7461265b"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950","target":{"file":"server/src/test/java/org/apache/seata/server/raft/RaftSyncMessageTest.java"},"deprecated":false,"digest":{"line_hashes":["326866492758033564522266814770884812850","92943081314547839519994155914845094603","42412005904802213185269323312139730164","330850014641258766465685285908095308185","113163570674742041073628827850416083581","302299791743018017812934817047216999398","251346984024152474143282836399109183374","213672456574546350475676074033696901937","44717939371268509494417845004523040839","144115631840712461690769059119426670709"],"threshold":0.9},"id":"CVE-2025-32897-7792f81b"},{"target":{"file":"compatible/src/test/java/io/seata/tm/api/DefaultFailureHandlerImplTest.java","function":"onBeginFailure"},"deprecated":false,"digest":{"length":326,"function_hash":"69413645204021743567426950099396618754"},"id":"CVE-2025-32897-884fdb5b","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9"},{"id":"CVE-2025-32897-907b506b","signature_type":"Line","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9","target":{"file":"tm/src/test/java/org/apache/seata/tm/api/DefaultFailureHandlerImplTest.java"},"deprecated":false,"digest":{"line_hashes":["215173368832176471242132037284754458404","305032704825348911215330062759723646232","163618769591464039381844358586532737951","107328969793023525655820777135945710337","317339715957054479303503280999366021643","307212327460262980954635851408249695992","276339125260561915457282481194820802964","140547074940766806655608472131492699319","174350547264623027348106163151060642331","10162338892946920728949814435737932849","334349791224166347928686719021351369262","107328969793023525655820777135945710337","300634779041623689618478763233866348006","50459287837539536243048118737281602061","233375589630845857206844704940219804078","161081529563893060517148914601534780865","197491897922221397590990071679749577085","89368058117736478701828344361097650381","27308704412086359555145297805837498242","301319239267573754008104887185413256567","222450974535972369463885271580295867730","244121519962982378680254867060810488396","95632042134146977834463884110560855540","230550138545905725533269700658427621704","248614934668312562197066148392379201343","206041177008454488933624853012107108510","144720166662055302258879218510818532341","94660915357466434881163650744661959389","219072849152372509987863076951385938844","329874858319699511374374840452843668006","107328969793023525655820777135945710337","84771242885442855081822921050681634259","151147112222226890928071623970661688574","215535698506305437485139376121484603910","14694940081743184738712572913449797815","197491897922221397590990071679749577085","89368058117736478701828344361097650381","27308704412086359555145297805837498242","92631555481375945709892771140716687871","299377563284640409359971873919771245737","71071283592129147174369364284906572370","150819172612671075925115838154738652001","230550138545905725533269700658427621704","248614934668312562197066148392379201343","283055200384401393662846797855649751488"],"threshold":0.9}},{"target":{"file":"compatible/src/test/java/io/seata/tm/api/DefaultFailureHandlerImplTest.java","function":"onCommitFailure"},"deprecated":false,"digest":{"length":780,"function_hash":"85391567855351372668753100169001057514"},"id":"CVE-2025-32897-abc1a04f","signature_type":"Function","signature_version":"v1","source":"https://github.com/apache/incubator-seata/commit/0ad2847465fa877a2c65ea84ed43f5b0984c3ce9"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}