CVE-2025-59328 json
Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data
published 2025-09-15 13 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-29218 , GHSA-5hmf-8wx5-4qq3
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users.
Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software.
Patch / fix
- maven org.apache.fory:fory-core 0.12.2
- apache fory 0.12.2
- org.apache.fory fory-core 0.12.2
- github.com/apache/fory@c3b4d3f commit
- github.com/apache/fory#2578 pull request
- github.com/apache/fory/releases/tag/v0.12.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.fory:fory-core | <0.12.2 |
0.12.2 |
Affected products
- Apache Software Foundation Apache Fory
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/fory/pull/2578
web
-
github.com
/apache/fory/commit/c3b4d3fe389e38495aeb8301d75da1ab658f0c6e
web
-
fory.apache.org
/security/
vendor-advisory
-
openwall.com
/lists/oss-security/2025/09/15/1
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59328
advisory
-
fory.apache.org
/security
web
-
github.com
/apache/fory
package
-
github.com
/apache/fory/releases/tag/v0.12.2
web
Sources
- CVE List CVE-2025-59328
- GitHub Advisory GHSA-5hmf-8wx5-4qq3
- NVD CVE-2025-59328
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.