CVE-2011-2894

score

<0.1

cvss

6.8

epss

8.6%

published

2011-10-04

kev added

—

first seen

2026-10-21

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6 contain an insecure deserialization vulnerability caused by deserializing objects from untrusted sources, letting remote attackers execute arbitrary code, exploit requires attacker to send malicious serialized objects.