{"action":"Upgrade org.apache.fory:fory-core to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"org.apache.fory:fory-core","cve_ids":["CVE-2026-50076"],"ecosystem":"Maven","epss":0.00742,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-8f39-v287-78jf","id":"tcs_01M5N8MHCAPWB3VTC5FF5CP1PS","modified_at":"2026-07-15T22:56:42.607897Z","published_at":"2026-06-04T18:30:32Z","references":["https://osv.dev/vulnerability/GHSA-8f39-v287-78jf","https://nvd.nist.gov/vuln/detail/CVE-2026-50076","https://fory.apache.org/security","https://github.com/apache/fory","http://www.openwall.com/lists/oss-security/2026/06/04/4"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-8f39-v287-78jf","url":"https://osv.dev/vulnerability/GHSA-8f39-v287-78jf"}],"summary":"Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path"}