CVE-2025-70974
1 advisory.
Maven/com.alibaba:fastjson CVE-2025-70974: critical 10
FASTJSON Includes Functionality from Untrusted Control Sphere
Action: Upgrade com.alibaba:fastjson to 1.2.48 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.48 | - |
Fixed versions
| 1.2.48 |
Sources
- osv: GHSA-jm7w-5684-pvh8
- https://nvd.nist.gov/vuln/detail/CVE-2025-70974
- https://access.redhat.com/security/cve/CVE-2025-70974
- https://bugzilla.redhat.com/show_bug.cgi?id=2428203
- https://github.com/alibaba/fastjson
- https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48
- https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce
- https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955
- https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger
- https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238
- https://www.freebuf.com/vuls/208339.html
- https://www.seebug.org/vuldb/ssvid-98020
CVE-2025-70974 · published · modified · JSON