PyPI/pyfory CVE-2025-61622: critical 9.8, EPSS 45.13%
Apache Pyfory python is vulnerable to deserialization of untrusted data
Action: Upgrade pyfory to 0.12.3 or later.
pip install pyfory==0.12.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 0.12.3 | - |
Fixed versions
| 0.12.3 |
Sources
- osv: GHSA-538v-3wq9-4h3r
- https://nvd.nist.gov/vuln/detail/CVE-2025-61622
- https://github.com/apache/fory/pull/2629
- https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
- https://github.com/apache/fory
- https://github.com/apache/fory/releases/tag/v0.12.3
- https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
- http://www.openwall.com/lists/oss-security/2025/09/29/3
CVE-2025-61622 · published · modified · JSON