Vulnerability · Published Oct 1, 2025 · Assigned by apache
CVE-2025-61622Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache Fory from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution. Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pyfory | 0.12.3 | GHSA-538v-3wq9-4h3r |
| PyPI | pyfory | 0.12.3 | PYSEC-2026-490 |
| PyPI | pyfury | no fix listed | GHSA-538v-3wq9-4h3r |
| PyPI | pyfury | no fix listed | PYSEC-2026-491 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Fory | 0.12.0 – through 0.12.2 |
| Apache Software Foundation | Apache Fory | 0.1.0 – through 0.10.3 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H