SA-CORE-2025-006 by anzuukino, mcdruid, larowlan, greggles, longwave, poker10, catch, xjm, drumm, akalata, ram4nd

Author: xjm

lib/Drupal/Core/Database/Transaction.php

@@ -38,6 +38,13 @@ public function __destruct() {
     $this->connection->transactionManager()->unpile($this->name, $this->id);
   }
 
+  /**
+   * Prevent transactions from being unserialized.
+   */
+  public function __wakeup(): void {
+    throw new \BadMethodCallException('Cannot unserialize ' . get_class($this));
+  }
+
   /**
    * Retrieves the name of the transaction or savepoint.
    */