Apache Fory PyFory ReduceSerializer DeserializationPolicy Bypass Vulnerability

A vulnerability exists in Apache Fory PyFory versions 0.13.0 prior to 1.0.0, allowing the ReduceSerializer to bypass DeserializationPolicy validation hooks. This deserialization of untrusted data can occur in Python-native mode with strict mode disabled. Applications are at risk if they deserialize attacker-controlled data and rely on DeserializationPolicy to limit unsafe classes, functions, or module attributes.

Impact

Exploitation of this vulnerability can lead to unauthorized deserialization of data, potentially allowing attackers to manipulate application behavior or introduce malicious elements.

Remediation

Users are advised to upgrade to Apache Fory PyFory version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths. Libraries and applications that depend on Apache Fory should update their dependency requirements and release patched versions.