CVE-2026-48207
Deserialization Flaw in Apache Fory PyFory
Publication date: 2026-05-21
Last updated on: 2026-05-22
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | fory | From 0.13.0 (inc) to 1.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability involves the deserialization of untrusted data in Apache Fory's PyFory component. Specifically, PyFory's ReduceSerializer can bypass the intended DeserializationPolicy validation hooks during the process of restoring reduce-state and resolving global names. This means that if an application deserializes data controlled by an attacker using PyFory's Python-native mode with strict mode disabled, and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes, it could be vulnerable.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker could potentially bypass security restrictions intended to prevent unsafe deserialization. This could allow the attacker to execute unauthorized code or manipulate application state by injecting malicious serialized data, leading to possible compromise of the application or its data.
What immediate steps should I take to mitigate this vulnerability?
Users of Apache Fory are recommended to upgrade to version 1.0.0 or later.
Version 1.0.0 enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.