Critical Vulnerabilities in Apache Fory Affecting Multiple Versions

Apache Fory has disclosed multiple vulnerabilities affecting versions 0.5.0 to 1.0.0. The most severe issue involves deserialization of untrusted data, which can lead to arbitrary code execution and denial of service. Specifically, versions 0.13.0 to 0.17.0 are vulnerable due to a bypass of DeserializationPolicy validation. Users are advised to upgrade to version 1.0.0 or later to mitigate these risks. The vulnerabilities were published as CVE-2026-48207 on May 21, 2026, and pose a significant threat to applications relying on this library. Attackers can exploit these vulnerabilities by deserializing attacker-controlled data, leading to potential system unavailability and code execution. Developers are urged to update their dependency requirements and release patched versions.

Key Points: • Apache Fory versions 0.5.0 to 1.0.0 are affected by critical vulnerabilities. • Deserialization issues can lead to arbitrary code execution and denial of service. • Users must upgrade to version 1.0.0 or later to mitigate these vulnerabilities.