PowSyBl Core allows deserialization of untrusted SparseMatrix data
Impact
What kind of vulnerability is it? Who is impacted?
This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that
can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method
of the SparseMatrix class.
This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be
exposed to untrusted input in at least two use cases:
- A user can adopt this method in an application where users can submit an
InputStreamand the application parses it into aSparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the
InputStreamfrom external sources.
Am I impacted?
You are vulnerable if you import non-controlled serialized SparseMatrix objects.
Patches
com.powsybl:powsybl-math:6.7.2 and higher
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not use SparseMatrix deserialization (SparseMatrix.read(...) methods).
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.powsybl:powsybl-math | >= 6.3.0, < 6.7.2 | 6.7.2 |
References
- https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959
- https://nvd.nist.gov/vuln/detail/CVE-2025-47771
- https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd
- https://github.com/powsybl/powsybl-core
- https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-502- Platform
- Java / Kotlin (Maven)
- Package
com.powsybl:powsybl-math- Disclosed
- 19.06.2025
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f5cx-h789-j959 - CC BY 4.0
Vulnerability history: com.powsybl:powsybl-math
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.