40 matches found
Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
aster-cli (0.1.2), aster-rpc (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-48207 via pyfory (>=0.13.2, <=0.16.0)
pyfory PYPI version =0.13.2, =0.1.1, =0.1.39, =0.1.50 Source cves: CVE-2026-48207 Source advisory: OSV:PYSEC-2026-2984...
PT-2026-59611
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
PYSEC-2026-491 Apache Pyfory python is vulnerable to deserialization of untrusted data
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...
Apache Pyfory python is vulnerable to deserialization of untrusted data
Deserialization of untrusted data inpython in pyforyversions 0.12.0 through 0.12.2, or thelegacypyfury versions from0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources.An attacker can craft a data stream tha...
PYSEC-2026-490 Apache Pyfory python is vulnerable to deserialization of untrusted data
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...
PT-2026-53566
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...
PT-2026-53565
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stre...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
Deserialization of Untrusted Data
Overview pyfory is an Apache Fory™ is a blazingly fast multi-language serialization framework powered by jit and zero-copy Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ReduceSerializer process. An attacker can execute arbitrary code or access...
GHSA-M5GW-83W2-7749 Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
aster-cli (0.1.2), aster-rpc (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-48207 via pyfory (>=0.13.2, <=0.16.0)
pyfory PYPI version =0.13.2, =0.1.1, =0.1.39, =0.1.50 Source cves: CVE-2026-48207 Source advisory: OSV:GHSA-M5GW-83W2-7749...
aster-cli (0.1.2), aster-rpc (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-48207 via pyfory (>=0.13.2, <=0.16.0)
pyfory PYPI version =0.13.2, =0.1.1, =0.1.39, =0.1.50 Source cves: CVE-2026-48207 Source advisory: GHSA-M5GW-83W2-7749...
Apache Fory PyFory Deserialization of Untrusted Data
Fory PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies o...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
EUVD-2026-31292
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
CVE-2026-48207
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
aster-cli (0.1.2), aster-rpc (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-48207 via pyfory (>=0.13.2, <=0.16.0)
pyfory PYPI version =0.13.2, =0.1.1, =0.1.39, =0.1.50 Source cves: CVE-2026-48207 Source advisory: MEND:CVE-2026-48207...
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...
CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory...