PUBLISHED
2026-05-21 17:16
MODIFIED
2026-05-21 17:16
EPSS (Prob. Exploit)
0.82%
Top 43.3%
> DESCRIPTION
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.
This issue affects Apache Fory: from before 1.0.0.
Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-m5gw-83w2-7749
CRITICAL
Apache Fory PyFory Deserialization of Untrusted Data
AFFECTED PACKAGES:
PIP / pyfory
>= 0.13.0, < 1.0.0
Fixed in: 1.0.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
ALIASES:
GHSA-m5gw-83w2-7749, PYSEC-2026-2984
> HISTORIQUE DES MODIFICATIONS
Première apparition
21/05/2026 17:16
Source: NVD
📊
ENRICHISSEMENT
01/06/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 1
Dernière mise à jour: 5 months ago