CVE-2026-50076

Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

CVSS 9.1 CRITICALEPSS 0.5%CWE-502

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

04 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Produtos afetados

Apache Software Foundation · Apache Fory

Referências

https://fory.apache.org/security http://www.openwall.com/lists/oss-security/2026/06/04/4