CVE-2025-59328

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59328
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59328.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59328
Aliases
Published
2025-09-15T17:15:36.240Z
Modified
2026-04-12T18:28:21.284136Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data. An attacker can supply a large, specially crafted data payload that, when processed, consumes an excessive amount of CPU resources during the deserialization process. This leads to CPU exhaustion, rendering the application or system using the Apache Fory library unresponsive and unavailable to legitimate users.

Users of Apache Fory are strongly advised to upgrade to version 0.12.2 or later to mitigate this vulnerability. Developers of libraries and applications that depend on Apache Fory should update their dependency requirements to Apache Fory 0.12.2 or later and release new versions of their software.

References

Affected packages

Git / github.com/apache/fory

Affected ranges

Type
GIT
Repo
https://github.com/apache/fory
Events
Introduced
51beb134f517917d572dd0cf2b21534d74ecc726
Fixed
2e3dc3a432dffe6e1715b8d26f7d10ebc14bbbb6
Database specific 
{
    "versions": [
        {
            "introduced": "0.5.0"
        },
        {
            "fixed": "0.12.2"
        }
    ]
}

Database specific

vanir_signatures_modified 
"2026-04-12T18:28:21Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59328.json"
vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "13348560598799346470951353187392645657",
                "198503490732960011406601192801542473906",
                "85060965923976166382192382169659179787",
                "8452601019083821052237675681232237085"
            ]
        },
        "target": {
            "file": "java/fory-format/src/main/java/org/apache/fory/format/row/binary/writer/BinaryWriter.java"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2025-59328-20434dda",
        "source": "https://github.com/apache/fory/commit/2e3dc3a432dffe6e1715b8d26f7d10ebc14bbbb6"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "236364232509520623930192930161949318295",
                "186329714448240266621709797559865686970",
                "196378768455106859499076027397166465969"
            ]
        },
        "target": {
            "file": "java/fory-format/src/main/java/org/apache/fory/format/row/binary/writer/BinaryRowWriter.java"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2025-59328-3ff6e568",
        "source": "https://github.com/apache/fory/commit/2e3dc3a432dffe6e1715b8d26f7d10ebc14bbbb6"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "211692584288598723279050039375466871068",
                "56115942126966123371552884218521468925"
            ]
        },
        "target": {
            "file": "java/fory-format/src/test/java/org/apache/fory/format/encoder/RowEncoderTest.java"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2025-59328-b70a70e5",
        "source": "https://github.com/apache/fory/commit/2e3dc3a432dffe6e1715b8d26f7d10ebc14bbbb6"
    }
]