Apache Fory Deserialization Flaw Lets Attackers Bypass Java Safety Checks
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jun 4, 2026
Apache disclosed CVE-2026-50076, an important- to high-severity deserialization vulnerability in the Java SDK of Apache Fory that affects org.apache.fory:fory-core versions before 1.1.0. The flaw lies in the Java ReplaceResolverSerializer replace-resolve path, where incomplete verification allows crafted Fory serialized data to bypass class registration requirements, TypeChecker enforcement, and DisallowedList protections during deserialization.
If an application processes untrusted external data streams, a remote attacker can trigger classpath-present readResolve and readExternal hooks on Java/JVM systems, creating a path to unauthorized code execution on backend servers. Apache fixed the issue in version 1.1.0 by adding stricter sanitization checks before deserialization and advised users to upgrade immediately and review deployments that deserialize externally supplied data; the vulnerability was reported by Venkatraman Kumar (r3dw0lfsec) of Securin.
