CVE-2026-50076 — Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

Description (CNA)

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Fory	affected 0 before 1.1.0

CWE

CWE-502

References

https://fory.apache.org/security

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/04/4