Skip to content
Critical Vulnerabilities in Apache Fory Affecting Multiple Versions

Critical Vulnerabilities in Apache Fory Affecting Multiple Versions

First seen 22 May 2026, 16:10 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •May 23, 2026 at 16:07 UTC
  • •Apache Fory versions 0.5.0 to 1.0.0 are affected by critical vulnerabilities.
  • •Deserialization issues can lead to arbitrary code execution and denial of service.
  • •Users must upgrade to version 1.0.0 or later to mitigate these vulnerabilities.

Apache Fory has disclosed multiple vulnerabilities affecting versions 0.5.0 to 1.0.0. The most severe issue involves deserialization of untrusted data, which can lead to arbitrary code execution and denial of service. Specifically, versions 0.13.0 to 0.17.0 are vulnerable due to a bypass of DeserializationPolicy validation. Users are advised to upgrade to version 1.0.0 or later to mitigate these risks. The vulnerabilities were published as CVE-2026-48207 on May 21, 2026, and pose a significant threat to applications relying on this library. Attackers can exploit these vulnerabilities by deserializing attacker-controlled data, leading to potential system unavailability and code execution. Developers are urged to update their dependency requirements and release patched versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 120d ago How this analysis works

Timeline

2026-05-21
CVE-2026-48207 published
Apache Fory disclosed a critical deserialization vulnerability affecting versions before 1.0.0.
Nvd.Nist
2026-05-22
Apache Fory security advisory released
Apache Fory outlined multiple vulnerabilities and recommended upgrades to mitigate risks.
fory.apache.org

More articles in this cluster (3)

Following this threat?

Track Apache Fory and CVE-2026-48207 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3