CVE-2025-53606

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).

This issue affects Apache Seata (incubating): 2.4.0.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
Apache Software FoundationApache Seata (incubating)2.4.0

References

Timeline

Published
Aug 8, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-536084.8An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForCVE-2025-536094.9A Relative Path Traversal vulnerability [CWE-23] in FortiWeb 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, 7.0.2 through 7CVE-2025-53619.8A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. This issue affects somCVE-2025-536189.1An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICVE-2025-536199.1An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICVE-2025-53629.8A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown funcCVE-2025-536209.2@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the CVE-2025-536216.9DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity CVE-2025-536225.2DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, anCVE-2025-536238.1The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitraryCVE-2025-5362410.0The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-contentCVE-2025-536258.7The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail
CVE-2025-53606: Critical severity, CVSS 9.8 | Vulnix