CVE-2026-48207 Detail

Nvd.Nist • May 22, 2026

Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes. This issue affects Apache Fory: from before 1.0.0. Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Apache Fory Affecting Multiple Versions Apache Fory has disclosed multiple vulnerabilities affecting versions 0.5.0 to 1.0.0. The most severe issue involves deserialization of untrusted data, which can lead to arbitrary code execution and denial of service. Specifically, versions 0.13.0 to 0.17.0 are vulnerable due to a bypass of DeserializationPolicy validation. Users are advised to upgrade to version 1.0.0 or later to mitigate these risks. The vulnerabilities were published as CVE-2026-48207 on May 21, 2026, and pose a significant threat to applications relying on this library. Attackers can exploit these vulnerabilities by deserializing attacker-controlled data, leading to potential system unavailability and code execution. Developers are urged to update their dependency requirements and release patched versions. 1 sources 72

Extracted Entities

CVE-2026-48207 Detail

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Tools (1)