Skip to content
OpenAdvisories

Package · PyPI

pyfory

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-48207

    Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement

    Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attac…

    Apache Software Foundation Apache Fory pyfory PyPI
  • Critical 9.8
    CVE-2025-61622 EPSS 49%

    Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory

    Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sour…

    Apache Software Foundation Apache Fory pyfory pyfury PyPI