Vulnerabilities in pkg:maven/com.powsybl/powsybl-math
PACKAGECVE-2025-47771 is a HIGH powsybl core allows deserialization of vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Powsybl math libraries in the Maven ecosystem. The issue involves powsybl core allows deserialization of untrusted sparsematrix data. Remediation is available by upgrading affected packages to version 6.7.2.
pkg:maven/com.powsybl/powsybl-math
Vulnerability advisories affecting package pkg:maven/com.powsybl/powsybl-math. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-f5cx-h789-j959 | CVE-2025-47771 | HIGH | PowSyBl Core allows deserialization of untrusted SparseMatrix data |
CVE-2025-47771 at a Glance
How to Fix CVE-2025-47771
To remediate this vulnerability, upgrade all affected Powsybl math dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>com.powsybl</groupId>
<artifactId>powsybl-math</artifactId>
<version>6.7.2</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=com.powsyblHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2025-47771, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=com.powsyblAnalyze the terminal output to locate any version of Powsybl math in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.7.2), your application is affected.
Note: The mvn dependency:tree -Dincludes=com.powsybl command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Powsybl math, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-47771 Affected Powsybl math Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
com.powsybl:powsybl-math
|
Maven |
≥ 6.3.0
< 6.7.2
|
6.7.2
|
References
Frequently Asked Questions
What is CVE-2025-47771?
Which Powsybl math versions are affected?
What version fixes CVE-2025-47771?
Is powsybl-math affected?
What CWE is associated with CVE-2025-47771?
How can I check Maven dependencies for CVE-2025-47771?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-f5cx-h789-j959",
"modified" : "2025-06-20T14:19:25Z",
"published" : "2025-06-19T16:19:16Z",
"aliases" : [ "CVE-2025-47771" ],
"summary" : "PowSyBl Core allows deserialization of untrusted SparseMatrix data",
"details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that\ncan lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method\nof the `SparseMatrix` class.\nThis method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be\nexposed to untrusted input in at least two use cases:\n- A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into\na `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege\nlevels.\n- A user adopts the method for a local tool but receives the `InputStream` from external sources.\n\n#### Am I impacted?\nYou are vulnerable if you import non-controlled serialized `SparseMatrix` objects.\n\n\n### Patches\ncom.powsybl:powsybl-math:6.7.2 and higher\n\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nDo not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).\n\n### References\n[powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "com.powsybl:powsybl-math"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.3.0"
}, {
"fixed" : "6.7.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 6.7.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-47771"
}, {
"type" : "WEB",
"url" : "https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/powsybl/powsybl-core"
}, {
"type" : "WEB",
"url" : "https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-502" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-06-19T16:19:16Z",
"nvd_published_at" : "2025-06-20T00:15:29Z"
}
}