PyPI/pyfury CVE-2025-61622: critical 9.8, EPSS 45.13%
Apache Pyfory python is vulnerable to deserialization of untrusted data
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1.0 | - | 0.10.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-491
- https://nvd.nist.gov/vuln/detail/CVE-2025-61622
- https://github.com/apache/fory/pull/2629
- https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
- https://github.com/apache/fory
- https://github.com/apache/fory/releases/tag/v0.12.3
- https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
- http://www.openwall.com/lists/oss-security/2025/09/29/3
- https://pypi.org/project/pyfury
- https://github.com/advisories/GHSA-538v-3wq9-4h3r
CVE-2025-61622 · published · modified · JSON