Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

CRITICAL 9.1CVE-2026-50076 · GHSA-8f39-v287-78jf · Published 04/06/2026 · updated 22/07/2026

Package	Affected versions	Patched versions
org.apache.fory:fory-core Maven	`< 1.1.0`	`1.1.0`
fory apache	`< 1.1.0`	`1.1.0`

Description

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.

Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-50076 · ADVISORY
fory.apache.org/security · WEB
apache/fory · PACKAGE
openwall.com/lists/oss-security/2026/06/04/4 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free