CVE-2026-50076: Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

Synopsis

Deserialization of untrusted data in Apache Fory's Java replace-resolve path allows a remote attacker with no authentication to bypass class registration, TypeChecker, and DisallowedList protections and invoke arbitrary readResolve/readExternal hooks on the server. The vulnerability is reachable over the network and requires no user interaction, enabling full read and write access to application data. A patched-image rebuild at version 1.1.0 is available on HarborGuard for environments running an affected version of fory-core.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Fory deserialization endpoint over the network; any internet- or intranet-exposed service accepting Fory serialized data is in scope.

• AuthenticationNot required

  No credentials or session token are needed; the attacker submits crafted serialized payloads as an anonymous caller.

• Victim interactionNot required

  The exploit is fully server-side and requires no action from a user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker reads confidential application data, including session material, credentials, and any objects reachable through readResolve or readExternal hooks on the server classpath.
• A successful attacker modifies server-side state by invoking writable hooks during deserialization, enabling tampering with persisted records or in-memory application objects.
• The bypass of TypeChecker and DisallowedList controls removes the primary defense layer, so any class present on the JVM classpath becomes a usable gadget chain target.