Apache Seata vulnerabilities

5 CVEs affecting Apache Seata, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-53606, published 2025-08-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-22399, published 2024-09-16. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct…
CVE-2025-32897, published 2025-06-28. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552…
CVE-2024-47552, published 2025-03-20. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache…
CVE-2024-54016, published 2025-03-20. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): through <=2.2.0. Users are recommended to…
CVE-2025-53606, published 2025-08-08. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to upgrade to version 2.5.0, which fixes the…