EUVD-2026-31292
GHSA-m5gw-83w2-7749
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable deserialization yielding RCE (C/I/A:H, PR:N), but AC:H because exploitation requires the non-default combination of Python-native mode, strict mode disabled, and reliance on DeserializationPolicy.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.
This issue affects Apache Fory: from before 1.0.0.
Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.
AnalysisAI
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolicy validation hooks via the ReduceSerializer, letting untrusted classes, functions, or module attributes be restored despite policy restrictions. All PyFory releases before 1.0.0 are affected when running Python-native mode with strict mode disabled, enabling attacker-controlled data to instantiate unsafe objects and achieve code execution. There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), but CVSS is 9.8 and SSVC rates technical impact as total with automatable exploitation.
Technical ContextAI
Apache Fory is a high-performance multi-language serialization framework; PyFory is its Python implementation. This flaw (CWE-502, Deserialization of Untrusted Data) resides in the ReduceSerializer path, which handles Python's reduce-based object reconstruction (analogous to pickle's __reduce__ protocol) and global-name resolution. DeserializationPolicy is Fory's allow/deny mechanism intended to gate which classes, functions, and module attributes may be reconstructed; the vulnerability is that ReduceSerializer's reduce-state restoration and global-name resolution paths did not consistently invoke those validation hooks, so the security control could be silently bypassed. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_fory:*, and the issue is specific to Python-native serialization mode rather than cross-language modes.
RemediationAI
Vendor-released patch: upgrade Apache Fory / PyFory to version 1.0.0 or later, which enforces DeserializationPolicy validation across the affected ReduceSerializer reduce-state and global-name-resolution paths, per the Apache advisory (https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass). If you cannot upgrade immediately, enable PyFory strict mode so that reduce-based reconstruction is disallowed rather than relying on the bypassable DeserializationPolicy (trade-off: strict mode may reject legitimate custom objects that depend on reduce semantics, potentially breaking application deserialization). Additionally, stop deserializing untrusted or attacker-reachable data with PyFory Python-native mode entirely, or place such deserialization behind authenticated, trusted-source-only channels (trade-off: requires validating every producer of serialized payloads). Do not depend on DeserializationPolicy allow/deny lists as your sole control on affected versions, since that is precisely the mechanism being bypassed.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today