PT-2025-39961 · Apache · Apache Fory

Bugbunny_Ai · Published 2025-09-30 · Updated 2026-05-30 · CVE-2025-61622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pyfory versions 0.12.0 through 0.12.2 pyfury versions 0.1.0 through 0.10.3

Description Deserialization of untrusted data in Python allows arbitrary code execution. An application is susceptible if it reads serialized data from untrusted sources. An attacker can craft a data stream that triggers the pickle-fallback serializer during deserialization, leading to the execution of the pickle.loads() function, which enables remote code execution.

Recommendations Upgrade pyfory to version 0.12.3 or later. Upgrade pyfury to pyfory version 0.12.3 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-61622

GHSA-538V-3WQ9-4H3R

Affected Products

Apache Fory

References · 32

• https://osv.dev/vulnerability/CVE-2025-61622 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622 · Security Note
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-538v-3wq9-4h3r · Vendor Advisory
• https://github.com/apache/fory · Note
• https://github.com/apache/fory/pull/2629 · Note
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b · Note
• https://github.com/apache/fory/releases/tag/v0.12.3 · Note
• https://t.me/cveNotify/137042 · Telegram Post
• https://twitter.com/Dinosn/status/2060124619420414200 · Twitter Post
• https://t.me/pentestingnews/68902 · Telegram Post
• https://twitter.com/fridaysecurity/status/1972843794824679432 · Twitter Post
• https://twitter.com/mercuryheavens/status/1984013425723457568 · Twitter Post
• https://reddit.com/r/Pentesting/comments/1oeh52y/today_i_crossed_6_digits_in_bounty_rewards · Reddit Post
• http://openwall.com/lists/oss-security/2025/09/29/3 · Note