Security Notice - Statement on Remote Code Execution Vulnerability in Fastjson2

Following the discovery of the remote code execution vulnerability in Fastjson2, Huawei has launched an immediate investigation. Attackers controlling JSON requests can exploit this vulnerability to execute arbitrary code on the target server. The investigation is completed. If you have deployed...

Deserialization of Untrusted Data

Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...

cc.ddrpa.dorian.polystash:polystash-spring-boot-starter (>=1.0.0, <=1.0.1), com.alibaba.fastjson2:fastjson2-extension (>=2.0.27, <=2.0.65) +46 more potentially affected by CVE-2025-12183 via org.lz4:lz4-pure-java (1.8.0)

org.lz4:lz4-pure-java MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.lz4:lz4-pure-java and may be impacted: - cc.ddrpa.dorian.polystash:polystash-spring-boot-starter =1.0.0, =2.0.27, =0.3.1, =0.40.8-public, =0.40.8-public,...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readArray

Detailed Report: https://oss-fuzz.com/testcase?key=5222228419739648 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: com.alibaba.fastjson2.JSONReader.readArray...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Detailed Report: https://oss-fuzz.com/testcase?key=6490567452459008 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: com.alibaba.fastjson2.JSONReader.readObject...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Detailed Report: https://oss-fuzz.com/testcase?key=5024052882505728 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: com.alibaba.fastjson2.JSONReader.readObject...

PT-2024-40632

Name of the Vulnerable Software and Affected Versions: fastjson2 affected versions not specified Description: A security exception crash has been reported. The crash involves the com.alibaba.fastjson2.JSONReader.readObject function, along with java.base/java.nio.charset.CharsetEncoder.replaceWith...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=4527111307591680 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Detailed Report: https://oss-fuzz.com/testcase?key=5242504851554304 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: com.alibaba.fastjson2.JSONReader.readObject...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONPathSegment$CycleNameSegment$MapLoop.accept

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=6140570544701440 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.writer.ObjectWriterImplList.write

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=5328979324108800 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=5263058763055104 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in java.base/java.util.HashMap$Node.hashCode

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=4536314488553472 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in java.base/java.util.AbstractMap.hashCode

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=5316395102240768 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readAny

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=6402878750457856 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=4883155558727680 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.writer.ObjectWriterImplMap.write

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=4864057160368128 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson2.JSONReader.readObject

Project: https://github.com/alibaba/fastjson2.git Detailed Report: https://oss-fuzz.com/testcase?key=6140698658471936 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in com.alibaba.fastjson.parser.DefaultJSONParser.parseArray

Detailed Report: https://oss-fuzz.com/testcase?key=5807481534414848 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

fastjson2:JsonFuzzer: Security exception in java.base/java.util.AbstractMap.hashCode

Detailed Report: https://oss-fuzz.com/testcase?key=5388668926033920 Project: fastjson2 Fuzzing Engine: libFuzzer Fuzz Target: JsonFuzzer Job Type: libfuzzerasanfastjson2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.AbstractMap.hashCode...