23 matches found
Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
PYSEC-2026-2984 Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
Deserialization of Untrusted Data
Overview pyfory is an Apache Fory™ is a blazingly fast multi-language serialization framework powered by jit and zero-copy Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ReduceSerializer process. An attacker can execute arbitrary code or access...
Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
GHSA-M5GW-83W2-7749 Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
CVE-2026-48207
Apache Fory's PyFory component is vulnerable to a deserialization of untrusted data flaw in the ReduceSerializer component. The root cause is that the serializer can bypass documented DeserializationPolicy validation hooks during global-name resolution and reduce-state restoration. An application...
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
Apache Fory 代码问题漏洞
Apache Fory is a serialization framework developed by the Apache Foundation. Versions of Apache Fory prior to 1.0.0 contained code vulnerabilities. These vulnerabilities stemmed from the ReduceSerializer in PyFory, which might bypass the DeserializationPolicy validation hook during state...
EUVD-2019-2130
Malware in sbrugna...
CVE-2019-10069
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly...
Godot Remote Code Execution Vulnerability
Godot is a cross-platform game engine. The engine supports the creation of 2D and 3D games through a unified interface. A security vulnerability exists in Godot 3.1 and earlier versions, which stems from the program failing to properly apply a deserialization policy. A remote attacker could explo...
DEBIAN-CVE-2019-10069
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly...
CVE-2019-10069
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly...
CVE-2019-10069
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly...
