CVE-2025-61622

PyPI/pyfory CVE-2025-61622: critical 9.8

Apache Pyfory python is vulnerable to deserialization of untrusted data

Action: Upgrade pyfory to 0.12.3 or later.

pip install pyfory==0.12.3

Affected

Fixed versions

Sources

• osv: GHSA-538v-3wq9-4h3r
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622
• https://github.com/apache/fory/pull/2629
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
• https://github.com/apache/fory
• https://github.com/apache/fory/releases/tag/v0.12.3
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
• http://www.openwall.com/lists/oss-security/2025/09/29/3

CVE-2025-61622 · published 2025-10-01T12:30:27Z · modified 2026-06-29T12:26:52.243778954Z · JSON

PyPI/pyfury CVE-2025-61622: critical 9.8

Apache Pyfory python is vulnerable to deserialization of untrusted data

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-538v-3wq9-4h3r#PyPI/pyfury
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622
• https://github.com/apache/fory/pull/2629
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
• https://github.com/apache/fory
• https://github.com/apache/fory/releases/tag/v0.12.3
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
• http://www.openwall.com/lists/oss-security/2025/09/29/3

CVE-2025-61622 · published 2025-10-01T12:30:27Z · modified 2026-06-29T12:26:52.243778954Z · JSON

PyPI/pyfory CVE-2025-61622: critical 9.8

Apache Pyfory python is vulnerable to deserialization of untrusted data

Action: Upgrade pyfory to 0.12.3 or later.

pip install pyfory==0.12.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-490
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622
• https://github.com/apache/fory/pull/2629
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
• https://github.com/apache/fory
• https://github.com/apache/fory/releases/tag/v0.12.3
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
• http://www.openwall.com/lists/oss-security/2025/09/29/3
• https://pypi.org/project/pyfory
• https://github.com/advisories/GHSA-538v-3wq9-4h3r

CVE-2025-61622 · published 2026-06-29T11:50:36.968662Z · modified 2026-07-01T20:23:02.648327Z · JSON

PyPI/pyfury CVE-2025-61622: critical 9.8

Apache Pyfory python is vulnerable to deserialization of untrusted data

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: PYSEC-2026-491
• https://nvd.nist.gov/vuln/detail/CVE-2025-61622
• https://github.com/apache/fory/pull/2629
• https://github.com/apache/fory/commit/379b948ecae5c3b849e5bdb3997978c9a163e40b
• https://github.com/apache/fory
• https://github.com/apache/fory/releases/tag/v0.12.3
• https://lists.apache.org/thread/vfn9hp9qt06db5yo1gmj3l114o3o2csd
• http://www.openwall.com/lists/oss-security/2025/09/29/3
• https://pypi.org/project/pyfury
• https://github.com/advisories/GHSA-538v-3wq9-4h3r

CVE-2025-61622 · published 2026-06-29T11:50:37.028397Z · modified 2026-07-01T20:23:02.702735Z · JSON