CVE-2026-50076: Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

June 4, 2026 (updated July 15, 2026)

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data.

Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

References

fory.apache.org/security
github.com/advisories/GHSA-8f39-v287-78jf
nvd.nist.gov/vuln/detail/CVE-2026-50076

Code Behaviors & Features

Detect and mitigate CVE-2026-50076 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →