Loading vulnerability…
Apache Fory fory-core Java SDK replace-resolve deserialization checks bypass
CVE-2026-50076 is a deserialization of untrusted data vulnerability in the Java replace-resolve path, described as the ReplaceResolverSerializer pathway, in Apache Fory fory-core Java SDK before version 1.1.0 on Java/JVM platforms. By supplying crafted Fory serialized data, a remote attacker can bypass multiple intended deserialization safeguards, including class registration enforcement, TypeChecker validation, and DisallowedList checks. Successful exploitation can cause the deserialization flow to invoke classpath-present readResolve and readExternal hooks, exposing applications that deserialize untrusted external Fory data streams to dangerous attacker-controlled object processing and potentially code-reachable gadget execution paths.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote unauthenticated attacker to defeat Apache Fory’s intended deserialization restrictions and reach classpath-available readResolve/readExternal hooks during deserialization. This can expose sensitive application data and permit unauthorized modification of application state; the provided CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates high confidentiality and integrity impact with no required privileges or user interaction. Supporting content also indicates this may lead to unauthorized code execution on backend servers depending on the classes available on the target classpath.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by preventing applications from deserializing untrusted or externally supplied Fory serialized data, especially across network-accessible endpoints. Restrict or disable use of vulnerable deserialization paths where feasible, limit reachable attack surface to trusted producers only, and review classpath contents for classes exposing dangerous readResolve or readExternal behavior. However, the provided advisory does not describe a complete vendor-supported workaround; upgrading to 1.1.0 or later is the primary mitigation.
Patch, then assume compromise.
Upgrade Apache Fory fory-core Java SDK to version 1.1.0 or later. The vendor states that version 1.1.0 fixes the issue, including stricter verification/sanitization checks in the affected deserialization path. Organizations should also audit dependency trees and identify applications or endpoints that ingest untrusted Fory-serialized data to ensure all affected deployments are updated.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.