[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8b0078b2-4dc0-a25c-184d-a44ad41006aa@apache.org>
Date: Thu, 21 May 2026 12:44:24 +0000
From: Chaokun Yang <chaokunyang@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-48207: Apache Fory: PyFory ReduceSerializer Incomplete
Policy Enforcement
Severity: important
Affected versions:
- Apache Fory (pyfory) 0.13.0 before 1.0.0
Description:
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.
This issue affects Apache Fory: from before 1.0.0.
Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.
Credit:
Lide Wen (reporter)
References:
https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass
https://fory.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-48207
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
