Read the docs
TI-2025-36891 Aliases CVE-2025-59328GHSA-5hmf-8wx5-4qq3

Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data

Priority LOW 30CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users. Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00685 52nd percentileScored 2026-11-07
Fix Fixed org.apache.fory:fory-core (Maven): 0.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Fory0.5.0 – 0.12.1—No fix listedCNA
—org.apache.fory:fory-core (Maven)before 0.12.20.12.2Patch availableGHSA-5hmf-8wx5-4qq3
  • Apache Fory VendorApache Affected 0.5.0 – 0.12.1 Fixed in — No fix listed CNA
  • org.apache.fory:fory-core (Maven) Vendor— Affected before 0.12.2 Fixed in 0.12.2 Patch available GHSA-5hmf-8wx5-4qq3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*0.5.0 to before 0.12.2VulnerableApache
  • cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:* Versions 0.5.0 to before 0.12.2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-5hmf-8wx5-4qq3 org.apache.fory:fory-core (Maven) Fixed in 0.12.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59328
  2. 2026-10-03 Alias added: GHSA-5hmf-8wx5-4qq3
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 6

  • TI-2025-38065 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory CVSS 3.1CRITICAL 9.8
  • TI-2026-50130 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization CVSS 3.1CRITICAL 9.8
  • TI-2026-46171 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths CVSS 3.1CRITICAL 9.8
  • TI-2026-46169 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface CVSS 3.1CRITICAL 9.8
  • TI-2026-35617 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement CVSS 3.1CRITICAL 9.8
  • TI-2026-50132 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path CVSS 3.1CRITICAL 9.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences