seata vulnerabilities and fixes

Recent CVEs affecting seata, with upgrade or downgrade steps. 5 tracked.

seata has 5 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-08-08. Highest priority: CVE-2025-32897 (score 68/100).

• CVE-2025-53606 CRITICAL 9.8 DOWNGRADE Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata
• CVE-2025-32897 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is
• CVE-2024-54016 MEDIUM 4.3 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating).
• CVE-2024-47552 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache S
• CVE-2024-22399 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in Apache Seata.  When developers disable authentication on t

FAQ

How do I fix seata vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is seata being exploited right now?

None of the tracked seata CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which seata CVE should I patch first?

CVE-2025-32897 currently ranks highest (68/100): Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is .

RSS feed for seata · ← Back to latest CVEs