RCE Vulnerability Found in Fastjson 1.x — Attacks Already Underway, No Patch Available

ThreatBook and Imperva are reporting attacks against a critical vulnerability in Fastjson — the popular Java library for working with JSON, developed by Alibaba. In vulnerable Spring Boot–based applications, a specially crafted JSON request allows arbitrary code to be executed without authentication, with the privileges of the Java process.

The vulnerability has been assigned the identifier CVE-2026-16723 and a CVSS score of 9.0, rated by Alibaba itself. The confirmed exploitation chain requires several conditions to line up: a Fastjson version between 1.2.68 and 1.2.83, an application built as an executable “fat” JAR (fat-JAR) for Spring Boot, a network-accessible route that passes attacker-controlled JSON to the parser, and SafeMode left disabled by default. AutoType, meanwhile, can remain turned off, and no suitable gadget needs to be present on the classpath.

How It Works

The researcher behind the discovery, Kirill Firsov of FearsOff Cybersecurity, traced the problem back to Fastjson's type-resolution mechanism. A controllable @type value turns into a lookup of a class as a resource. Inside a compatible fat-JAR, a specially crafted path to a nested JAR can pull in someone else's bytecode, and a @JSONType annotation in that resource is treated as a signal of trust, allowing the class to pass the checks and load. A separate variant for newer JDK versions downloads a remote JAR and reaches it through /proc/self/fd.

Alibaba's developers confirmed that the chain works on Spring Boot 2.x, 3.x and 4.x with JDK 8, 11, 17 and 21. Ordinary (non-fat) JARs, universal uber-JARs, and WAR deployments under Tomcat or Jetty were not affected.

No Patch

Alibaba published an advisory on July 21, but as of July 25 it had still not released a fixed version of Fastjson 1.x. As temporary measures, it recommends enabling SafeMode with the -Dfastjson.parser.safeMode=true flag or switching to the com.alibaba:fastjson:1.2.83_noneautotype build. The long-term solution is migrating to Fastjson2, which is not affected by the vulnerability because it uses neither resource probing nor annotation-based trust.

On July 22, ThreatBook stated that it had recorded exploitation “in the wild” just two days after adding detection. Imperva notes activity against organizations in the finance, healthcare and retail sectors, predominantly in the United States. Yet neither vendor provided a number of attacks, evidence of successful code execution, or the names of any victims — this is only observed activity, not confirmed breaches. There is also a telling inconsistency: the CISA-ADP assessment of July 23 flagged exploitation as not occurring, and as of July 25 the flaw was not in CISA's Known Exploited Vulnerabilities catalog.

Organizations are advised to take inventory of their direct and transitive dependencies on Fastjson and to check systems for suspicious @type values, nested JAR URLs, unexpected outbound connections, child processes, and web shells. Adding to the irony, version 1.2.83 was once recommended as a safe upgrade following the 2022 AutoType bypass — and now this final 1.x release has itself ended up in the blast radius.

Source: The Hacker News