PT-2025-37727 · Unknown · Apache Fory

R00T4Dm · Published 2025-09-08 · Updated 2025-09-20 · CVE-2025-59328

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Fory versions prior to 0.12.2

Description The issue is a Denial of Service (DoS) resulting from insecure deserialization of untrusted data. An attacker can provide a large, specially crafted data payload that consumes excessive CPU resources during deserialization, leading to CPU exhaustion and rendering the application or system unresponsive.

Recommendations Upgrade to version 0.12.2 or later.

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11414

CVE-2025-59328

GHSA-5HMF-8WX5-4QQ3

Affected Products

Apache Fory

References · 15

• https://fory.apache.org/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59328 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59328 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hmf-8wx5-4qq3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11414 · Security Note
• https://github.com/apache/fory · Note
• https://github.com/apache/fory/pull/2578 · Note
• https://github.com/apache/fory/commit/c3b4d3fe389e38495aeb8301d75da1ab658f0c6e · Note
• https://github.com/apache/fory/releases/tag/v0.12.2 · Note
• https://twitter.com/oss_security/status/1968124046534643807 · Twitter Post
• https://github.com/advisories/GHSA-5hmf-8wx5-4qq3 · Note
• https://t.me/CVEtracker/32534 · Telegram Post
• https://twitter.com/CVEnew/status/1969292023959089248 · Twitter Post
• http://openwall.com/lists/oss-security/2025/09/15/1 · Note
• https://twitter.com/VulmonFeeds/status/1967781391594131960 · Twitter Post