CVE-2026-16723

Name of the Vulnerable Software and Affected Versions fastjson versions 1.2.68 through 1.2.83

Description A remote code execution (RCE) issue exists in the fastjson library, specifically impacting Spring Boot applications. This flaw allows an unauthenticated attacker to execute arbitrary code with the privileges of the Java process by sending a malicious JSON request. The issue is exploitable under the stock default configuration, requiring no AutoType enablement or classpath gadget. Real-world incidents have been reported, with active probes targeting the healthcare, finance, and retail sectors.

Recommendations For versions 1.2.68 through 1.2.83, add -Dfastjson.parser.safeMode=true to the startup flags. For versions 1.2.68 through 1.2.83, switch the dependency to com.alibaba:fastjson:1.2.83 noneautotype. Implement stringent input validation. Review and limit process privileges for Java applications. Apply network segmentation. Monitor for suspicious process execution or outbound connections from affected applications.