Safety companies ThreatBook and Imperva say attackers are focusing on a vital flaw in Fastjson, Alibaba’s JSON library for Java. In affected Spring Boot functions, a malicious JSON request can execute code with out authentication, with the privileges of the Java course of.
Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS rating of 9.0. The confirmed chain requires Fastjson 1.2.68 by means of 1.2.83, a Spring Boot executable fat-JAR, a network-reachable path that sends attacker-controlled JSON to an affected parser, and SafeMode left at its disabled default. AutoType can stay disabled, and no classpath gadget is required.
As of July 25, Alibaba had not launched a hard and fast Fastjson 1.x model. Organizations that can’t migrate instantly ought to allow SafeMode with -Dfastjson.parser.safeMode=true or use com.alibaba:fastjson:1.2.83_noneautotype. Alibaba lists migration to Fastjson2 because the long-term repair.
Alibaba revealed its advisory on July 21 following accountable disclosure by Kirill Firsov of FearsOff Cybersecurity. The maintainers described the vulnerability as requiring “no AutoType enablement” and “no classpath gadget.” They verified the chain on Spring Boot 2.x, 3.x, and 4.x with JDK 8, 11, 17, and 21.
Firsov traced the problem to Fastjson’s type-resolution path. An attacker-controlled @sort worth may be changed into a class-resource lookup. In a appropriate Spring Boot fat-JAR, a crafted nested JAR path can fetch attacker-controlled bytecode. An @JSONType annotation in that useful resource can then be handled as a belief sign, permitting the category to cross Fastjson’s sort checks and cargo.
His technical evaluation additionally describes a newer-JDK path that downloads a distant JAR and references it by means of /proc/self/fd.
The exploit is dependent upon the Spring Boot executable fat-JAR loader. Alibaba lists plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments as unaffected. Reachable entry factors embrace JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class). Binding enter to a hard and fast class is just not ample when an object accommodates an Object or Map discipline the place the payload may be nested.
ThreatBook stated on July 22 that its platform had captured in-the-wild exploitation after including detection assist two days earlier. Its laboratory outcomes have been narrower: it reproduced full code execution in a Spring Boot fat-JAR on JDK 8, whereas its embedded Tomcat check produced solely a distant JAR fetch or server-side request forgery.
Imperva reported exercise in opposition to monetary providers, healthcare, computing, retail, and different organizations, primarily in america, with smaller volumes in Singapore and Canada. It stated browser impersonators generated most requests, whereas Ruby and Go instruments represented about 30% collectively.
Neither vendor revealed assault counts, uncooked requests, execution proof, named victims, or confirmed compromises. Their studies set up noticed exploit exercise, not proof of profitable code execution in opposition to a real-world goal or a breach.
A July 23 CISA-ADP evaluation nonetheless marked exploitation as none. The Hacker Information confirmed on July 25 that the flaw was absent from CISA’s present Identified Exploited Vulnerabilities catalog. The out there sources don’t clarify the mismatch.
The Hacker Information additionally discovered no patched Fastjson 1.x artifact within the mission’s GitHub tags or Maven Central repository as of July 25. Model 1.2.83 stays the most recent normal 1.x launch, whereas 1.2.83_noneautotype stays the out there restricted construct.
Organizations ought to stock direct and transitive Fastjson dependencies and examine affected techniques for suspicious @sort values, nested JAR URLs, surprising outbound connections, little one processes, file adjustments, and internet shells. Fastjson2 is just not affected as a result of it doesn’t use the identical resource-probing or annotation-based belief path.
The Hacker Information has reached out to Alibaba for clarification on the affected variations and Fastjson 1.x patch plans, and to Imperva for particulars in regards to the reported exploitation exercise. We’ll replace the story with any response.
Fastjson 1.2.83 was Alibaba’s really useful improve for a separate AutoType bypass disclosed in 2022. That ultimate 1.x launch now sits contained in the affected vary for CVE-2026-16723.
