{"id":"GHSA-358m-fq53-hp87","summary":"akka-cluster-metrics uses Java serialization for cluster metrics","details":"In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.","aliases":["CVE-2025-53393"],"modified":"2025-06-30T21:44:39.666816Z","published":"2025-06-29T00:30:19Z","database_specific":{"nvd_published_at":"2025-06-28T23:15:21Z","cwe_ids":["CWE-502"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-06-30T21:21:59Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53393"},{"type":"WEB","url":"https://github.com/akka/akka/pull/32748"},{"type":"WEB","url":"https://github.com/akka/akka/commit/d69a082abfa26ccc076f090a6486ccfee9d7c481"},{"type":"PACKAGE","url":"https://github.com/akka/akka"}],"affected":[{"package":{"name":"com.typesafe.akka:akka-cluster-metrics_3","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-cluster-metrics_3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.10.6"}]}],"versions":["2.6.17","2.6.18","2.6.19","2.6.20","2.6.21","2.7.0","2.7.0-M1","2.7.0-M2","2.7.0-M3","2.7.0-M4","2.7.0-M5","2.7.1","2.8.0","2.8.0-M1","2.8.0-M2","2.8.0-M3","2.8.0-M4","2.8.0-M5","2.8.0-M6","2.8.1","2.8.1-M1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.9.0-M1","2.9.0-M2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-358m-fq53-hp87/GHSA-358m-fq53-hp87.json"}},{"package":{"name":"com.typesafe.akka:akka-cluster-metrics_2.13","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-cluster-metrics_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.10.6"}]}],"versions":["2.5.23","2.5.24","2.5.25","2.5.26","2.5.27","2.5.28","2.5.29","2.5.30","2.5.31","2.5.32","2.6.0","2.6.0-M3","2.6.0-M4","2.6.0-M5","2.6.0-M6","2.6.0-M7","2.6.0-M8","2.6.0-RC1","2.6.0-RC2","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.15-M1","2.6.16","2.6.17","2.6.18","2.6.19","2.6.2","2.6.20","2.6.21","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.0-M1","2.7.0-M2","2.7.0-M3","2.7.0-M4","2.7.0-M5","2.7.1","2.8.0","2.8.0-M1","2.8.0-M2","2.8.0-M3","2.8.0-M4","2.8.0-M5","2.8.0-M6","2.8.1","2.8.1-M1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.9.0-M1","2.9.0-M2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-358m-fq53-hp87/GHSA-358m-fq53-hp87.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L"}]}