CVE-2026-50076

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-502

Description

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

References

https://fory.apache.org/security
http://www.openwall.com/lists/oss-security/2026/06/04/4

Status: profiled · ingested 2026-07-23T00:00:18.000Z