Apache Fory Java SDK Deserialization Vulnerability
An early warning has been issued regarding a reported deserialization vulnerability in the Apache Fory Java SDK, specifically affecting versions prior to 1.1.0. This vulnerability may allow a remote attacker to bypass certain security checks.
What happened
An early warning has been issued for a potential deserialization vulnerability in the Apache Fory Java SDK. The issue reportedly affects versions of the fory-core component prior to 1.1.0. This vulnerability appears to allow a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks by invoking readResolve/readExternal hooks via specially crafted serialized data.
The vulnerability is under investigation and has been tracked under the ID GHSA-8F39-V287-78JF. The recommended action for affected users is to upgrade to version 1.1.0 or later of the fory-core component. For more detailed information, primary sources should be consulted.
Software engineers using Apache Fory Java SDK in their projects should assess their exposure by checking the versions of fory-core in use. If any version prior to 1.1.0 is detected, immediate upgrade to a non-vulnerable version is advised. Further details and confirmations are expected as the investigation progresses.
How 0Day mitigates this
fory-core is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.