PUBLISHED
2026-06-04 17:16
MODIFIED
2026-06-04 17:16
EPSS (Prob. Exploit)
0.52%
Top 55.8%
> DESCRIPTION
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.
Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-8f39-v287-78jf
CRITICAL
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
AFFECTED PACKAGES:
MAVEN / org.apache.fory:fory-core
< 1.1.0
Fixed in: 1.1.0
> HISTORIQUE DES MODIFICATIONS
Première apparition
04/06/2026 17:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 1
Dernière mise à jour: 4 months ago