CVE-2026-48207

Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes. This issue affects Apache Fory: from before 1.0.0. Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/21/10	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-21 17:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-48207

Mitre link : CVE-2026-48207

CVE.ORG link : CVE-2026-48207

JSON object : View

Products Affected

apache

fory

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-48207", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48207", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-21T17:10:26.856661Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.13.0", "lessThan": "1.0.0", "versionType": "semver"}], "packageName": "pyfory", "collectionURL": "https://pypi.org/", "defaultStatus": "unaffected"}]}], "published": "2026-05-21T17:16:21.857", "references": [{"url": "https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/21/10", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.\n\nThis issue affects Apache Fory: from before 1.0.0.\n\nMitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue."}, {"lang": "es", "value": "Deserializaci\u00f3n de datos no confiables en Apache Fory PyFory. El ReduceSerializer de PyFory podr\u00eda eludir los ganchos de validaci\u00f3n documentados de DeserializationPolicy durante la restauraci\u00f3n del estado de reducci\u00f3n y la resoluci\u00f3n de nombres globales. Una aplicaci\u00f3n es vulnerable si deserializa datos controlados por el atacante usando el modo nativo de Python de PyFory con el modo estricto deshabilitado y se basa en DeserializationPolicy para restringir clases, funciones o atributos de m\u00f3dulo inseguros.\n\nEste problema afecta a Apache Fory: desde antes de la versi\u00f3n 1.0.0.\n\nMitigaci\u00f3n: Se recomienda a los usuarios de Apache Fory actualizar a la versi\u00f3n 1.0.0 o posterior, que aplica la validaci\u00f3n de DeserializationPolicy para las rutas afectadas de ReduceSerializer y, por lo tanto, soluciona este problema."}], "lastModified": "2026-07-23T16:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A215346-77E6-41E4-800B-07CAEC26B055", "versionEndExcluding": "1.0.0", "versionStartIncluding": "0.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}