CVE-2025-59328: Apache Fory Denial of Service Vulnerability

CVE-2025-59328 Overview

CVE-2025-59328 is a denial of service vulnerability in Apache Fory, a high-performance serialization framework. The flaw stems from insecure deserialization of untrusted data ([CWE-502]). An attacker with network access and low privileges can submit a specially crafted payload that consumes excessive CPU during deserialization. Processing the malicious input exhausts CPU resources and renders the affected application unresponsive to legitimate users. Apache has released Apache Fory 0.12.2 to address the issue.

Critical Impact
Remote attackers can trigger CPU exhaustion in any service that deserializes untrusted data through Apache Fory, causing application-wide denial of service.

Affected Products

Apache Fory versions prior to 0.12.2
Applications that embed Apache Fory as a serialization dependency
Downstream libraries that transitively depend on vulnerable Apache Fory versions

Discovery Timeline

2025-09-15 - CVE-2025-59328 published to NVD
2025-09-15 - Advisory published on the OpenWall OSS Security list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59328

Vulnerability Analysis

Apache Fory deserializes incoming byte streams into in-memory objects for cross-language data exchange. The library does not adequately constrain the computational cost of processing attacker-controlled payloads. A crafted payload forces the deserializer into work-intensive code paths that dominate CPU time on the host. The result is a network-reachable denial of service against any service that accepts Fory-encoded input from untrusted sources.

The vulnerability is classified under [CWE-502] (Deserialization of Untrusted Data). Unlike classic deserialization flaws that yield remote code execution, this issue affects availability only. Confidentiality and integrity remain unaffected, but a single request can stall or starve a worker process. Services that expose Fory deserialization behind public endpoints or shared message buses face the greatest exposure.

Root Cause

Apache Fory versions prior to 0.12.2 accept deserialization inputs without enforcing sufficient bounds on payload complexity or resource consumption. Processing a large or adversarially structured object graph triggers algorithmic behavior that scales poorly with input size. This produces sustained CPU exhaustion on the deserializing thread.

Attack Vector

Exploitation requires network access to an endpoint that deserializes Fory-encoded data and a minimum level of authenticated access. No user interaction is required. An attacker submits a single crafted payload to the target service and the deserialization routine consumes CPU cycles until the request is rejected or the process becomes unresponsive. Repeated submissions amplify the impact into a sustained outage.

No verified proof-of-concept code is publicly available. Refer to the Apache Fory Security Overview for vendor-supplied technical details.

Detection Methods for CVE-2025-59328

Indicators of Compromise

Sudden, sustained CPU utilization spikes on services that process Apache Fory payloads without a corresponding increase in request volume
Unusually large or structurally complex Fory-encoded request bodies received from untrusted clients
Deserialization worker threads that remain blocked or fail to return within expected latency windows

Detection Strategies

Instrument Fory deserialization call sites with timing and payload-size metrics, and alert when either exceeds baseline thresholds
Inspect application and reverse-proxy logs for repeated requests to endpoints that accept serialized input from the same source
Correlate CPU saturation events with request traces to identify malicious payloads reaching deserialization code paths

Monitoring Recommendations

Track per-endpoint CPU time and request duration histograms for services that use Apache Fory
Enable rate limiting and payload-size caps at the ingress tier and log rejected requests for review
Monitor dependency manifests for the presence of Apache Fory versions below 0.12.2 across the build fleet

How to Mitigate CVE-2025-59328

Immediate Actions Required

Upgrade Apache Fory to version 0.12.2 or later in all first-party services and rebuild affected artifacts
Audit software bills of materials and dependency graphs for transitive references to vulnerable Apache Fory versions
Restrict Fory deserialization endpoints to authenticated, trusted callers until patching is complete

Patch Information

Apache has released Apache Fory 0.12.2, which addresses CVE-2025-59328. Users should upgrade directly to 0.12.2 or later. Library maintainers who ship products that depend on Apache Fory should update their dependency constraints to >= 0.12.2 and publish new releases so downstream consumers can absorb the fix. Full details are available in the Apache Fory Security Overview.

Workarounds

Enforce strict maximum payload sizes at load balancers or API gateways to reject oversized Fory inputs before they reach deserialization
Apply request timeouts and CPU-time limits on worker threads so runaway deserialization operations are terminated automatically
Isolate services that deserialize Fory data behind authenticated interfaces and remove exposure from untrusted networks

bash

# Example: pin Apache Fory to the fixed version in Maven
# pom.xml dependency block
<dependency>
  <groupId>org.apache.fory</groupId>
  <artifactId>fory-core</artifactId>
  <version>0.12.2</version>
</dependency>