CVE-2026-48207

Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes. This issue affects Apache Fory: from before 1.0.0. Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.

• CWE-502

• https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypassVendor Advisory
• https://www.openwall.com/lists/oss-security/2026/05/21/10Mailing List, Third Party Advisory

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48192A vulnerability has been identified in Mendix Studio Pro 10.…6.8
• CVE-2026-4820IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does n…4.3
• CVE-2026-48203Improper Neutralization of Special Elements in Output Used b…9.1
• CVE-2026-48204Improper Input Validation, Improper Access Control vulnerabi…9.8
• CVE-2026-48205Improper Input Validation, Server-Side Request Forgery (SSRF…9.1
• CVE-2026-48206Improper Input Validation, Authorization Bypass Through User…5.3
• CVE-2026-48208An improper neutralization of active SVG content in OTRS or …6.5
• CVE-2026-48209An improper neutralization of user-controllable input in OTR…7.1
• CVE-2026-4821Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-48210An improper default configuration in OTRS 2026.3.1 causes ti…5.7
• CVE-2026-48213Open ISES Tickets before 3.44.2 contains a reflected cross-s…5.4
• CVE-2026-48214Open ISES Tickets before 3.44.2 contains a reflected cross-s…5.4