CVE-2026-50076

Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

CVSS 9.1 CRITICALEPSS 0.5%CWE-502

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

04 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Apache Software Foundation · Apache Fory

References

https://fory.apache.org/security http://www.openwall.com/lists/oss-security/2026/06/04/4