Executive brief
Apache Fory is a high-performance serialization framework used to convert Java objects into a format that can be stored or transmitted over a network. A security flaw in the Java SDK allows remote attackers to bypass built-in security filters and execute unauthorized code logic by sending specially crafted data. This could lead to unauthorized access to sensitive information or the modification of application data, potentially compromising the integrity of the entire system.
Technical details
A deserialization vulnerability exists in the Java 'replace-resolve' path of the Apache Fory fory-core SDK. The root cause is a failure to properly enforce security constraints during the processing of ReplaceResolverSerializer data, allowing an attacker to bypass class registration requirements, TypeChecker validations, and DisallowedList protections. By providing a crafted Fory serialized data stream, a remote, unauthenticated attacker can trigger the execution of readResolve or readExternal hooks for classes present on the classpath. This can lead to arbitrary object instantiation or further exploitation depending on the available gadgets. The issue is resolved in version 1.1.0.
Affected products
- Apache Software Foundation Fory < 1.1.0
Timeline
- 2026-06-04: disclosed
- 2026-06-04: advisory
- 2026-06-04: patched: Version 1.1.0 released