{"id":"CVE-2026-48207","summary":"Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement","details":"Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.\n\nThis issue affects Apache Fory: from before 1.0.0.\n\nMitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.","aliases":["GHSA-m5gw-83w2-7749","PYSEC-2026-2984"],"modified":"2026-07-15T01:49:20.903282937Z","published":"2026-05-21T15:51:12.292Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.13.0"},{"fixed":"1.0.0"}]},{"extracted_events":[{"fixed":"1.0.0"}],"source":"DESCRIPTION"}],"cna_assigner":"apache","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48207.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/05/21/10"},{"type":"WEB","url":"https://pypi.org/"},{"type":"ADVISORY","url":"https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48207.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48207"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/fory","events":[{"introduced":"471a646d2d3c3aad32870c76e986dc19b51de6d4"},{"fixed":"36a01b6253d5974f13be3258205ac13f0ceaee44"}],"database_specific":{"extracted_events":[{"introduced":"0.13.0"},{"fixed":"1.0.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48207.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}