CVE-2026-16723 — Vulnerability in com.alibaba:fastjson — CVE Details

CRITICAL

fastjson has a remote code execution (RCE) vulnerability

Published July 23, 2026Updated September 10, 2026Source: osv

Summary

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

Advisory Timeline

First published July 23, 2026 (81 days ago).
Last revised September 10, 2026 — 49 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
com.alibaba:fastjson	maven	1.2.68, 1.2.68.sec10, 1.2.69, 1.2.69_noneautotype (+17 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-20
Improper Input ValidationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-16723?: fastjson has a remote code execution (RCE) vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2026-16723?: CVE-2026-16723 affects com.alibaba:fastjson. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-16723 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-crf3-v9rr-v7hj

Related CVEs

CVE-2022-39198
CRITICAL
Hessian Lite for Apache Dubbo deserialization vulnerability
CVE-2026-107726
CRITICAL
Hazelcast allows arbitrary member memory access by low-privileged client
CVE-2025-70974
CRITICAL
FASTJSON Includes Functionality from Untrusted Control Sphere
CVE-2026-107282
CRITICAL
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies