CVE-2026-50076

Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

Published Jun 4, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.

Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

Analysis

Technical impact

The vulnerability exists in the deserialization path of Apache Fory’s replace‑resolve feature. It allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks, enabling the invocation of readResolve/readExternal hooks for classes already present on the application classpath. This flaw can lead to arbitrary code execution and is classified as CWE‑502.

Affected Systems

Apache Software Foundation’s Apache Fory fory‑core Java SDK on Java/JVM platforms. Versions prior to 1.1.0 are affected.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not yet listed in CISA KEV, indicating no known public exploits at this time. However, the CVSS score of 9.1 points to a high severity flaw, and because the attack vector relies on the transmission of crafted serialized data—possible over network interfaces or file uploads—the risk of exploitation remains high. The flaw permits full compromise of affected applications when executed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Fory

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.0

Configuration 1 [-]

cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Fory

Version	Status	Scheme	Platform
`[0,1.1.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Apache Fory fory‑core Java SDK to version 1.1.0 or later.
If an upgrade cannot be performed immediately, restrict deserialization to trusted data sources and enforce a strict whitelist of allowable classes in the application’s deserialization logic.
Deploy monitoring to detect unauthorized deserialization attempts and review logs for suspicious activity.

Generated by OpenCVE AI on June 4, 2026 at 18:22 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-8f39-v287-78jf	Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.520% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/06/04/4
https://fory.apache.org/security

History

Jun 8, 2026 1:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:fory::::::::

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache fory
Vendors & Products		Apache Apache fory

Jun 4, 2026 6:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/06/04/4

Jun 4, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 4, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.
Title		Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass
Weaknesses		CWE-502
References		https://fory.apache.org/security