What this actually is.
Technical background, root cause, and affected surface.
The Java ReplaceResolverSerializer (replace-resolve path) in Apache Fory fory-core before 1.1.0 lets crafted Fory serialized data bypass class registration, TypeChecker and DisallowedList checks and invoke readResolve/readExternal hooks of classes present on the classpath.
- Product
- Apache Fory
- Vendor
- Apache
- Severity
- Critical
- CVSS Score
- 9.1
- Status
- Published
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-502: Deserialization of Untrusted Data
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
fory-core: ReplaceResolverSerializer - replace-resolve deserialization path does not enforce class registration, TypeChecker or DisallowedList before invoking readResolve/readExternal
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Bypass of deserialization safeguards; invocation of arbitrary classpath readResolve/readExternal hooks (confidentiality and integrity impact)
C:H · I:H · A:N
CWE-502: Deserialization of Untrusted Data
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade Apache Fory fory-core to 1.1.0 or later.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor
Fixed release published (1.1.0)
CVE published to MITRE
Disclosed 30 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.