DeserializationPolicy bypass in Apache Fory PyFory ReduceSerializer (CVE-2026-48207)

PyFory's ReduceSerializer fails to enforce DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when operating in Python-native mode with strict mode disabled. Applications that deserialize attacker-controlled data while relying on a custom DeserializationPolicy to restrict unsafe classes, functions, or module attributes are exposed to policy bypass, potentially allowing access to otherwise restricted objects. Affected versions: - 0.13.0 through 0.17.0 for pyfory We recommend updating to: 1.0.0. CVSS 9.8 · our assessment: act_now Reference: https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass Details: https://vuln.today/cve/CVE-2026-48207