CVE-2025-61622: Apache Fory RCE Vulnerability

CVE-2025-61622 Overview

CVE-2025-61622 is a critical insecure deserialization vulnerability affecting Apache Fory's Python serialization library (pyfory). The vulnerability exists in pyfory versions 0.12.0 through 0.12.2, as well as the legacy pyfury versions from 0.1.0 through 0.10.3. Applications that process pyfory serialized data from untrusted sources are susceptible to arbitrary code execution through exploitation of the pickle-fallback serializer mechanism.

Critical Impact

This vulnerability allows unauthenticated remote attackers to achieve arbitrary code execution by crafting malicious serialized data that forces the application to use the vulnerable pickle.loads function, potentially leading to complete system compromise.

Affected Products

• Apache Fory pyfory versions 0.12.0 through 0.12.2
• Apache Fory legacy pyfury versions 0.1.0 through 0.10.3

Discovery Timeline

• 2025-10-01 - CVE-2025-61622 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-61622

Vulnerability Analysis

This vulnerability stems from an insecure deserialization flaw (CWE-502) in the Apache Fory Python serialization library. The core issue lies in the library's implementation of a pickle-fallback mechanism that can be triggered during the deserialization process. When an application deserializes data from an untrusted source using pyfory, an attacker can craft a malicious data stream that specifically instructs the deserializer to fall back to Python's native pickle module.

Python's pickle.loads() function is inherently unsafe when processing untrusted data, as it can execute arbitrary Python code during object reconstruction. This well-known security concern makes the pickle-fallback feature particularly dangerous in contexts where serialized data may originate from untrusted sources. The vulnerability requires no authentication or user interaction to exploit, and successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the application processing the malicious data.

Root Cause

The root cause of this vulnerability is the presence of a pickle-fallback serializer in the pyfory library that can be activated through specially crafted input data. The design decision to include pickle as a fallback serialization mechanism introduced an unsafe code path that bypasses any security controls implemented in the primary pyfory serialization format. When the fallback is triggered, the application directly invokes pickle.loads() on attacker-controlled data, enabling arbitrary code execution through pickle's object reconstruction process.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker targets applications that accept pyfory serialized data from external sources such as network connections, file uploads, or inter-process communication channels. The attacker crafts a malicious serialized payload that contains instructions to select the pickle-fallback serializer during deserialization. When the vulnerable application processes this payload, it triggers the pickle.loads() function, which then executes the attacker's embedded Python code.

The attack flow typically involves:

1. Identifying an application that uses pyfory for deserializing external data
2. Crafting a serialized payload that forces the pickle-fallback mechanism
3. Embedding malicious Python objects designed to execute code upon unpickling
4. Sending the malicious payload to the target application
5. Achieving arbitrary code execution when the application deserializes the data

Detection Methods for CVE-2025-61622

Indicators of Compromise

• Unexpected process spawning or child processes from applications using pyfory serialization
• Unusual network connections originating from applications that process serialized data
• Anomalous file system activity, particularly in temporary directories or sensitive system locations
• Memory artifacts indicating pickle deserialization of unexpected object types

Detection Strategies

• Monitor application logs for deserialization errors or unexpected pickle operations
• Implement network traffic analysis to detect malformed or suspicious serialized payloads
• Deploy runtime application self-protection (RASP) solutions to detect deserialization attacks
• Use SentinelOne's behavioral AI to identify anomalous process execution patterns following deserialization operations

Monitoring Recommendations

• Audit all applications in your environment that depend on pyfory or pyfury Python libraries
• Implement centralized logging for applications processing external serialized data
• Configure alerting for any execution of pickle.loads() in production environments
• Establish baseline behavior for applications using pyfory to detect deviations indicative of exploitation

How to Mitigate CVE-2025-61622

Immediate Actions Required

• Upgrade pyfory to version 0.12.3 or later immediately, as this version removes the vulnerable pickle-fallback serializer
• Inventory all applications and services using pyfory or legacy pyfury libraries to determine exposure
• If immediate patching is not possible, implement network segmentation to limit exposure of vulnerable applications
• Review application architecture to ensure serialized data from untrusted sources is not processed by vulnerable library versions

Patch Information

Apache has addressed this vulnerability in pyfory version 0.12.3, which completely removes the pickle-fallback serializer mechanism. Users should upgrade to this version or later to remediate the vulnerability. For detailed information, refer to the Apache Mailing List Discussion and the Openwall OSS-Security Update.

Workarounds

• Restrict network access to applications using vulnerable pyfory versions to trusted sources only
• Implement input validation layers that reject unexpected serialization formats before reaching pyfory
• Deploy web application firewalls (WAF) or API gateways configured to inspect and block suspicious serialized payloads
• Consider temporarily disabling functionality that relies on deserializing external pyfory data until patching is complete

# Upgrade pyfory to patched version
pip install --upgrade pyfory>=0.12.3

# Verify installed version
pip show pyfory | grep Version