Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-04 | 3 | Disclosure1General1Patch1 |
| 2026-06-07 | 1 | Disclosure1 |
| 2026-06-08 | 1 | Disclosure1 |
| 2026-06-10 | 2 | General2 |
CVE-2026-50076: Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass https://www.openwall.com/lists/oss-security/2026/06/04/4 Severity: important
Post summary
A new deserialization bypass vulnerability (CVE‑2026‑50076) in Apache Fory’s Java ReplaceResolverSerializer has been identified as important, with no PoC, exploit, or patch currently described.
CVE-2026-50076 Apache Fory Vulnerability high-severity flaw bypasses Core Java serialization checks -- https://securityonline.info/apache-fory-vulnerability-patch
Post summary
The post announces CVE‑2026‑50076, a high‑severity Apache Fory vulnerability that bypasses Core Java serialization checks, and indicates that a patch is available.
【3軸解説】「Apache Software FoundationのApache Foryにおける信頼できないデータのデシリアライゼーションに関する脆弱性（CVE-2026-50076）」を、背景 / 目的 / 効果 の 3 軸で読み解きます。 背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ note メンバーシップ: https://note.com/yuusan_security/membership
Post summary
The post offers a conceptual overview of CVE-2026-50076, noting the vulnerability type, but provides no PoC, exploit code, active use evidence, or patch information.
【3軸解説】「Apache Software FoundationのApache Foryにおける信頼できないデータのデシリアライゼーションに関する脆弱性（CVE-2026-50076）」を、背景 / 目的 / 効果 の 3 軸で読み解きます。 背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ note メンバーシップ: https://note.com/yuusan_security/membership
Post summary
The tweet mentions a blog post analyzing CVE‑2026‑50076, but it does not provide technical details, exploitation info, or patch guidance.
🔵 Apache Fory (#Java SDK), Deserialization Checks Bypass, #CVE-2026-50076 (Important) -DC-Jun2026-259 https://dailycve.com/apache-fory-java-sdk-deserialization-checks-bypass-cve-2026-50076-important-dc-jun2026-259/
Post summary
The post announces a newly disclosed CVE (CVE‑2026‑50076) affecting Apache Fory Java SDK, highlighting a deserialization bypass vulnerability, but it provides no PoC, exploit code, active exploitation evidence, or patch information.
🚨 Critical - Apache Fory Java SDK Deserialization Vulnerability (CVE-2026-50076) A critical vulnerability in Apache Fory allows remote attackers to bypass class registration, TypeChecker, and DisallowedList protections through crafted serialized data. Successful exploitation may allow attackers to invoke dangerous readResolve and readExternal hooks present on the classpath. Affected versions: • fory-core <1.1.0 Impact: • deserialization of untrusted data • security control bypass • potential remote code execution paths depending on classpath contents 👉 Upgrade to Apache Fory 1.1.0+.
Post summary
A critical deserialization flaw (CVE‑2026‑50076) in Apache Fory Java SDK permits bypass of security checks and potential remote code execution depending on the classpath. The issue is mitigated by upgrading to version 1.1.0 or later.
CVE-2026-50076 CVE-2026-50076 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50076
Post summary
The content merely lists the CVE identifier and links to a vulnerability details page, providing no additional context on exploits, patches, or technical characteristics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | fory | - | - | - |