Deserialization Vulnerability in Apache Fory Core Java SDK
CVE-2026-50076

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Fory
Vendor
CVE Published:
4 June 2026

What is CVE-2026-50076?

A notable vulnerability in Apache Fory's core Java SDK prior to version 1.1.0 can allow a remote attacker to execute unauthorized actions by exploiting the deserialization of untrusted data. This flaw permits the bypass of critical security mechanisms such as class registration, TypeChecker, and DisallowedList validations, enabling attackers to invoke readResolve/readExternal hooks simply by submitting crafted serialized data. Users are strongly encouraged to migrate to version 1.1.0 or later to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Apache Fory 0 < 1.1.0

References

https://fory.apache.org/security
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Venkatraman Kumar (r3dw0lfsec), Securin
.