fory.apache.org Critical Vulnerabilities in Apache Fory Affecting Multiple Versions
Article Content
- •Apache Fory versions 0.5.0 to 1.0.0 are affected by critical vulnerabilities.
- •Deserialization issues can lead to arbitrary code execution and denial of service.
- •Users must upgrade to version 1.0.0 or later to mitigate these vulnerabilities.
Apache Fory has disclosed multiple vulnerabilities affecting versions 0.5.0 to 1.0.0. The most severe issue involves deserialization of untrusted data, which can lead to arbitrary code execution and denial of service. Specifically, versions 0.13.0 to 0.17.0 are vulnerable due to a bypass of DeserializationPolicy validation. Users are advised to upgrade to version 1.0.0 or later to mitigate these risks. The vulnerabilities were published as CVE-2026-48207 on May 21, 2026, and pose a significant threat to applications relying on this library. Attackers can exploit these vulnerabilities by deserializing attacker-controlled data, leading to potential system unavailability and code execution. Developers are urged to update their dependency requirements and release patched versions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Apache Fory and CVE-2026-48207 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…