{"id":"CVE-2026-48207","aliases":["GHSA-m5gw-83w2-7749","PYSEC-2026-2984"],"url":"https://o3.security/vulnerability/CVE-2026-48207","summary":"Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement","details":"Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.\n\nThis issue affects Apache Fory: from before 1.0.0.\n\nMitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.","published":"2026-05-21T15:51:12.292Z","modified":"2026-08-12T03:51:17.206226451Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00574,"percentile":0.44681,"asOf":"2026-08-18"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"pyfory","fixedVersion":"1.0.0"}],"fix":null,"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/05/21/10"},{"type":"WEB","url":"https://pypi.org/"},{"type":"ADVISORY","url":"https://fory.apache.org/security/#cve-2026-48207-pyfory-reduceserializer-deserializationpolicy-bypass"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48207.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48207"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.206226451Z"}}