PT-2026-63585 · Alibaba · Fastjson

Kirill Firsov · CVE-2026-16723 · Publicado 2026-07-23 · Atualizado 2026-07-23

NVD

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-20

CWE-502

Identificadores relacionados

CVE-2026-16723

Produtos afetados

Fastjson

Referências · 2

• https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-16723 · Nota de Segurança