What is the CVSS score of CVE-2025-70974?

CVE-2025-70974 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2025-70974?

CVE-2025-70974 presents critical security risk rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.. A patch is available.

How to fix or mitigate CVE-2025-70974?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Java CVE-2025-70974

CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-01-09 cve@mitre.org

GHSA-jm7w-5684-pvh8

Java Authentication Bypass

10.0

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

10.0 CRITICAL

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 09, 2026 - 07:16 nvd

CRITICAL 10.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

190 maven packages depend on com.alibaba:fastjson (47 direct, 143 indirect)

Ecosystem-wide dependent count for version 1.2.48.

DescriptionCVE.org

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

AnalysisAI

Fastjson before 1.2.48 has a well-known autoType deserialization vulnerability enabling JNDI injection and RCE. Exploited in the wild since 2023 through GodzillaWebShell. Maximum CVSS 10.0 with scope change.

Technical ContextAI

When an @type key in JSON specifies a Java class, Fastjson instantiates it and calls its methods (CWE-829). An attacker can reference JNDI-capable classes that connect to attacker-controlled LDAP/RMI servers, which return malicious Java objects for code execution. This is the same class of vulnerability as Log4Shell.

Affected ProductsAI

Fastjson before 1.2.48

RemediationAI

Upgrade Fastjson to 1.2.83+ or migrate to fastjson2. Implement JNDI restrictions (JDK 8u191+ helps but is not sufficient). Monitor for GodzillaWebShell indicators.