[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e491456b-3b97-6165-3ce6-fee5f76df4aa@apache.org>
Date: Mon, 15 Sep 2025 02:26:59 +0000
From: Chaokun Yang <chaokunyang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-59328: Apache Fory: Denial of Service (DoS) due to
Deserialization of Untrusted malicious large Data
Severity: moderate
Affected versions:
- Apache Fory (org.apache.fory:fory-core) 0.5.0 before 0.12.1
Description:
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users.
Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software.
Credit:
r00t4dm of meituan security (reporter)
References:
https://fory.apache.org
https://www.cve.org/CVERecord?id=CVE-2025-59328
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
