Loading vulnerability…
Unauthenticated RCE in Alibaba Fastjson Type Resolution
CVE-2026-16723 is a remote code execution vulnerability affecting Alibaba Fastjson versions 1.2.68 through 1.2.83, with a confirmed execution chain in Spring Boot executable fat-JAR deployments. During processing of attacker-controlled @type values, checkAutoType invokes getResourceAsStream before fully enforcing type restrictions. Compatible classloader behavior permits retrieval of attacker-controlled class resources, while trust in the @JSONType annotation allows malicious classes to bypass restrictions and execute code during initialization. The vulnerability is exploitable under the default configuration without enabling AutoType or supplying third-party deserialization gadgets. Affected entry points include JSON.parse and JSON.parseObject overloads. Fastjson 2.x does not use the vulnerable resource-probing and annotation-based trust mechanism.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the privileges of the Java application, compromising application confidentiality, integrity, and availability. Potential consequences include sensitive-data and credential theft, malware or web-shell deployment, application modification, service disruption, persistence, and lateral movement. Full host compromise depends on the Java process's permissions and accessible resources. The resource-lookup behavior can also cause blind server-side request forgery where the complete code-execution chain is unavailable.
If you can’t patch tonight, do this now.
Enable SafeMode using -Dfastjson.parser.safeMode=true or ParserConfig.getGlobalInstance().setSafeMode(true). A restricted com.alibaba:fastjson:1.2.83_noneautotype build is also identified as an interim alternative. Apply WAF filtering for suspicious JSON type declarations and remote or nested JAR references as defense in depth. Merely leaving AutoType disabled or binding deserialization to a concrete class is insufficient when attacker-controlled values can reach Object or Map fields. For Huawei NGFW or data center firewalls, update the IPS signature database to version 20260723** or later.
Patch, then assume compromise.
Prioritize migration to unaffected Fastjson 2.x after compatibility testing, updating both direct and transitive dependencies and rebuilding affected applications. For applications remaining on 1.x, Fastjson 1.2.84 is reported as fixing this vulnerability in a July 29, 2026 release; verify the vendor release and deploy the confirmed fixed artifact. Earlier advisories stating that no 1.x patch was available predate that reported release.
13 exploits validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
99 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.