Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.powsybl:powsybl-math

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1MavenPublished

    PowSyBl Core allows deserialization of untrusted SparseMatrix data

    CVE-2025-47771 · GHSA-f5cx-h789-j959

    Affected
    • Maven com.powsybl:powsybl-math >= 6.3.0, <= 6.7.1
    Fixed in
    6.7.2· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method of the SparseMatrix class. This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an InputStream and the application parses it into a SparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the InputStream from external sources. Am I impacted? You are vulnerable if you import non-controlled serialized SparseMatrix objects. Patches com.powsybl:powsybl-math:6.7.2 and higher…

    Recommended action: Upgrade to 6.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →