CVE-2024-22399: Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-16 · updated 2026-06-17
Weakness: CWE-502

Description

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol. This issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0. Users are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.

Affected products

Apache Software Foundation Apache Seata (incubating): from 1.0.0 before 1.8.1; 2.0.0 — fixed in 1.8.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Seata (incubating) 1.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-22399 or the next vulnerability affects your stack