PT-2026-46269

CVE-2026-50076

Published

2026-06-04

Updated

2026-06-08

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Fory fory-core versions prior to 1.1.0

Description Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. By using crafted Fory serialized data, an attacker can invoke readResolve() and readExternal() hooks present on the classpath.

Recommendations Upgrade to version 1.1.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

R3Dw0Lfsec

Venkatraman Kumar

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data