CVE-2025-59328 Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data
Remote attackers can cause denial of service in applications using Apache Fory by sending large malicious payloads that exhaust CPU resources during deserialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59328?
CVE-2025-59328 is a medium-severity unsafe deserialization vulnerability in Apache Fory, published on 15 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users.
Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software.
Weakness: CWE-502
Which versions are affected by CVE-2025-59328?
2 open source packages ship an affected version, including org.apache.fory:fory-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.fory:fory-core Maven | All versions | 0.12.2 |
org.apache.fory:fory-core Maven | All versions | 0.12.2 |
Products include Apache Fory.
How do I fix CVE-2025-59328?
Upgrade org.apache.fory:fory-core to 0.12.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-59328 being exploited?
There is no known exploitation of CVE-2025-59328 in the wild and no public exploit code.
Other vulnerabilities in Apache Fory
- CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
- CVE-2026-64606 Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
- CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
- CVE-2026-48207 Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
- CVE-2025-61622 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
Sources
Also known as GHSA-5hmf-8wx5-4qq3.